StackRadar

CVE-2025-22227

Medium

Advisory

Published 16 Jul 2025In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
95
of 17,781 indexed, latest versions
Container images
82
deployed by those charts
Fix available
1 of 1
affected package

Reactor Netty HTTP is vulnerable to credential leaks during chained redirects

Carried by container images the latest versions of 95 of 17,781 indexed charts deploy, on 82 images.

Affected packageAffected versionsFixed inImages
reactor-netty-httpmaven1.0.1, 1.0.4, 1.0.7, 1.0.11+33 more1.2.882
OSV records
GHSA-4q2v-9p7v-3v22

Charts affected

95 by stars
ChartLatestAffected imagesRadar Score
druiddruid-helmVerified publisher37.0.21 of 3See more

druid druid-helm 37.0.2

1 of the 3 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
reactor-netty-http@1.0.48
1.2.8

Open the chart page →

3,812
elasticsearch-clusterwiremindVerified publisher4.5.21 of 2See more

elasticsearch-cluster wiremind 4.5.2

1 of the 2 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
library/elasticsearch:8.19.1289729a95066a
reactor-netty-http@1.0.45
1.2.8

Open the chart page →

2,283
nessienessie0.108.41 of 1See more

nessie nessie 0.108.4

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
ghcr.io/projectnessie/nessie:0.108.4c0f42874c810
reactor-netty-http@1.0.48
1.2.8

Open the chart page →

204
thehivestrangebee-helmOfficialVerified publisher1.0.61 of 7See more

thehive strangebee-helm 1.0.6

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
reactor-netty-http@1.0.45
1.2.8

Open the chart page →

16,210
druidwiremindVerified publisher1.22.11 of 3See more

druid wiremind 1.22.1

1 of the 3 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
apache/druid:29.0.10cef139b6bf1
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

7,930
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.1-debian-11-r29cfd2df1294d
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

27,267
hertzbeathertzbeatOfficialVerified publisher1.8.11 of 4See more

hertzbeat hertzbeat 1.8.1

1 of the 4 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
reactor-netty-http@1.2.2
1.2.8

Open the chart page →

14,000
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
reactor-netty-http@1.1.13
1.2.8

Open the chart page →

107,811
repoflowrepoflow-helm-public0.9.11 of 8See more

repoflow repoflow-helm-public 0.9.1

1 of the 8 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
library/elasticsearch:8.15.0310b9fc03b06
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

13,521
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
thmmniii/fbs-core:v1.27.15438517d9fc2
reactor-netty-http@1.0.32
1.2.8

Open the chart page →

28,534
structurizrvirtualrootVerified publisher0.5.01 of 1See more

structurizr virtualroot 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
structurizr/onpremises:2025.11.094b5ffb5119c8
reactor-netty-http@1.0.48
1.2.8

Open the chart page →

4,378
vrijbrpvrijbrpVerified publisher0.1.51 of 5See more

vrijbrp vrijbrp 0.1.5

1 of the 5 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
vrijbrp/haal-centraal-brp-bevragen:develop5c770c2ae48c
reactor-netty-http@1.0.31
1.2.8

Open the chart page →

8,811
pitchforkexpediagroup0.1.41 of 1See more

pitchfork expediagroup 0.1.4

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
expediagroup/pitchfork:1.314f2cf61e7de9
reactor-netty-http@1.0.11
1.2.8

Open the chart page →

3,309
gentrace-self-hostedgentrace-self-hostedVerified publisher0.1.31 of 9See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
provectuslabs/kafka-ui:latest8f2ff02d64b0
reactor-netty-http@1.1.10
1.2.8

Open the chart page →

15,562
amgraviteeioVerified publisher4.12.62 of 3See more

am graviteeio 4.12.6

2 of the 3 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
graviteeio/am-gateway:4.12.607b7f6dc267a
reactor-netty-http@1.1.0
1.2.8
graviteeio/am-management-api:4.12.6a8eb04ee0c70
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

2,088
hawkhawk1.1.51 of 4See more

hawk hawk 1.1.5

1 of the 4 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
ghcr.io/privacyengineering/hawk-service:latestbfedf47bb5e0
reactor-netty-http@1.1.13
1.2.8

Open the chart page →

13,610
hertzbeatkubesphere-testVerified publisher1.4.11 of 4See more

hertzbeat kubesphere-test 1.4.1

1 of the 4 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
apache/iotdb:0.13.3-nodeafa47bf1692a
reactor-netty-http@1.0.4
1.2.8

Open the chart page →

7,710
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.215d4647fd491
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

37,373
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
treskon/portrait:DEV-latest88e813f22347
reactor-netty-http@1.1.24
1.2.8

Open the chart page →

31,844
reservation-appreservation-app1.0.91 of 4See more

reservation-app reservation-app 1.0.9

1 of the 4 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
zbalogh/reservation-api-server:1.0.97c247e399a1f
reactor-netty-http@1.0.23
1.2.8

Open the chart page →

6,639
signserver-cesignserverOfficialVerified publisher2.3.51 of 1See more

signserver-ce signserver 2.3.5

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
keyfactor/signserver-ce:7.3.2798fbbe00283
reactor-netty-http@1.0.48
1.2.8

Open the chart page →

2,406
stardogstardog3.1.01 of 3See more

stardog stardog 3.1.0

1 of the 3 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
stardog/stardog:latest2714e5c4b3c1
reactor-netty-http@1.0.48
1.2.8

Open the chart page →

293
starwhalestarwhaleVerified publisher0.6.151 of 4See more

starwhale starwhale 0.6.15

1 of the 4 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
ghcr.io/star-whale/server:0.6.158368359c8dd0
reactor-netty-http@1.0.26
1.2.8

Open the chart page →

13,486
gatewayaccount-serviceVerified publisher0.4.21 of 1See more

gateway account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
vitalii1992/api-gateway-service:latestaabe6ac39356
reactor-netty-http@1.1.7
1.2.8

Open the chart page →

2,853
connector-rollout-workerairbyteVerified publisher1.9.21 of 1See more

connector-rollout-worker airbyte 1.9.2

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
airbyte/connector-rollout-worker:2.0.2-alpha-c905e75d42813fcc191
reactor-netty-http@1.2.7
1.2.8

Open the chart page →

829
aktoakto0.2.01 of 7See more

akto akto 0.2.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-dashboard:latestb53a854bd7c1
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

13,613
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

9,321
akto-central-setupakto1.1.102 of 5See more

akto-central-setup akto 1.1.10

2 of the 5 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-dashboard:1.69.2b53a854bd7c1
reactor-netty-http@1.0.39
1.2.8
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:1.66.9138c8b82c398
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

4,905
akto-dashboardakto0.1.71 of 1See more

akto-dashboard akto 0.1.7

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
aktosecurity/akto-api-security-dashboard:latest3aeaee66bc66
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

1,162
akto-dbabsakto0.1.91 of 1See more

akto-dbabs akto 0.1.9

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:latestf669a6eacf8c
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

1,125
akto-regional-setupakto1.3.11 of 9See more

akto-regional-setup akto 1.3.1

1 of the 9 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.5.35d4eab1c36b9
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

7,603
data-ingestion-serviceakto0.1.61 of 1See more

data-ingestion-service akto 0.1.6

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-servicedigest-pinned213aded7adc5
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

3,442
amorphieamorphie0.1.21 of 18See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
camunda/zeebe:8.4.5ab5abc09e407
reactor-netty-http@1.1.15
1.2.8

Open the chart page →

28,131
apimap-apiapimapOfficialVerified publisher1.8.111 of 1See more

apimap-api apimap 1.8.11

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
apimap/api:v1.8.11ae2b3ab00177
reactor-netty-http@1.0.24
1.2.8

Open the chart page →

2,231
james-komposeappscodeVerified publisher0.1.01 of 4See more

james-kompose appscode 0.1.0

1 of the 4 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
reactor-netty-http@1.1.9
1.2.8

Open the chart page →

16,975
arlas-aiasarlas-stackVerified publisher28.8.01 of 22See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
reactor-netty-http@1.0.45
1.2.8

Open the chart page →

40,238
automatedconfigurationassist-iot-automated-configuration1.0.01 of 5See more

automatedconfiguration assist-iot-automated-configuration 1.0.0

1 of the 5 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
provectuslabs/kafka-ui:latest8f2ff02d64b0
reactor-netty-http@1.1.10
1.2.8

Open the chart page →

14,728
bluerange-serverbluerangeOfficialVerified publisher1.3.11 of 1See more

bluerange-server bluerange 1.3.1

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
bluerange/bluerange:26.1.307c8f73b55df
reactor-netty-http@1.2.5
1.2.8

Open the chart page →

1,816
rpc-routerchronicleVerified publisher0.2.91 of 1See more

rpc-router chronicle 0.2.9

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
drpcorg/dshackle:0.54.08858fae1859d
reactor-netty-http@1.1.10
1.2.8

Open the chart page →

6,447
eoloplannerdfa-amm-eoloplannerVerified publisher0.1.01 of 7See more

eoloplanner dfa-amm-eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
oscarsotosanchez/toposervice:v1.0d4d020e9f272
reactor-netty-http@1.0.1
1.2.8

Open the chart page →

27,550
kafka-uidoubanVerified publisher1.5.21 of 1See more

kafka-ui douban 1.5.2

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.2.0185da4ad3e88
reactor-netty-http@1.2.3
1.2.8

Open the chart page →

1,269
eoloplannerdreyg-jescribanob-chart-eoloplanner0.1.01 of 7See more

eoloplanner dreyg-jescribanob-chart-eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
oscarsotosanchez/toposervice:v1.0d4d020e9f272
reactor-netty-http@1.0.1
1.2.8

Open the chart page →

24,656
dshackledysnixVerified publisher0.1.11 of 2See more

dshackle dysnix 0.1.1

1 of the 2 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.12ac2a4bc66ab6
reactor-netty-http@1.0.11
1.2.8

Open the chart page →

2,237
eolicplantseolicplantsVerified publisher0.1.01 of 7See more

eolicplants eolicplants 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
oscarsotosanchez/toposervice:v1.0d4d020e9f272
reactor-netty-http@1.0.1
1.2.8

Open the chart page →

27,291
eoloPlanteolo-plannerVerified publisher0.1.01 of 7See more

eoloPlant eolo-planner 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.239fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

27,537
eoloplannereoloplannerVerified publisher0.1.01 of 7See more

eoloplanner eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

32,205
eoloPlannerCommunicationsKubernetes3eoloplannercommunicationskuberneteshelmVerified publisher0.1.01 of 7See more

eoloPlannerCommunicationsKubernetes3 eoloplannercommunicationskuberneteshelm 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.239fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

27,537
eoloplanner-mcaeoloplanner-mcaVerified publisher0.1.01 of 7See more

eoloplanner-mca eoloplanner-mca 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
oscarsotosanchez/toposervice:v1.0d4d020e9f272
reactor-netty-http@1.0.1
1.2.8

Open the chart page →

27,256
eoloplannereoloplanner-molynx-gat0.1.01 of 7See more

eoloplanner eoloplanner-molynx-gat 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

28,482
eolo-plannereolo-planner-repo0.1.01 of 7See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

27,096

Container images carrying it

82 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/elasticsearch:8.15.0310b9fc03b06
reactor-netty-http@1.0.39
1.2.8
1
library/elasticsearch:9.5.38d09295845fe
reactor-netty-http@1.0.45
1.2.8
1
library/elasticsearch:9.5.19656a9ca03f8
reactor-netty-http@1.0.45
1.2.8
1
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
reactor-netty-http@1.1.11
1.2.8
1
maksimkavalenka/microservices-learning.resource-service:latest13ad9bb170a0
reactor-netty-http@1.1.11
1.2.8
1
openbas/platform:2.0.5d986d80b0a75
reactor-netty-http@1.1.25
1.2.8
1
redestroyder/authorization-service:0.0.1740364a619fd
reactor-netty-http@1.0.15
1.2.8
1
redestroyder/business-service:0.0.1db03499a0726
reactor-netty-http@1.0.15
1.2.8
1
scorpiobroker/scorpio:scorpio-aaio_2.1.0db55012043df
reactor-netty-http@1.0.13
1.2.8
1
slagattollas/toposervice-practica:latestdc63973dae0d
reactor-netty-http@1.0.1
1.2.8
1
stardog/stardog:latest2714e5c4b3c1
reactor-netty-http@1.0.48
1.2.8
1
structurizr/onpremises:2025.11.094b5ffb5119c8
reactor-netty-http@1.0.48
1.2.8
1
thmmniii/fbs-core:v1.27.15438517d9fc2
reactor-netty-http@1.0.32
1.2.8
1
treskon/portrait:DEV-latest88e813f22347
reactor-netty-http@1.1.24
1.2.8
1
trinodb/trino:45038c6f24ab1a4
reactor-netty-http@1.0.43
1.2.8
1
trinodb/trino:405ee80ab5eeab2
reactor-netty-http@1.0.14
1.2.8
1
vitalii1992/api-gateway-service:latestaabe6ac39356
reactor-netty-http@1.1.7
1.2.8
1
vlebediantsev/logic-ms:latestdf8bf38c535b
reactor-netty-http@1.0.20
1.2.8
1
vrijbrp/haal-centraal-brp-bevragen:develop5c770c2ae48c
reactor-netty-http@1.0.31
1.2.8
1
zahoriaut/zahori-server:0.1.17b2de13916f3e
reactor-netty-http@1.0.27
1.2.8
1
zbalogh/reservation-api-server:1.0.97c247e399a1f
reactor-netty-http@1.0.23
1.2.8
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
reactor-netty-http@1.1.9
1.2.8
1
ghcr.io/curium-rocks/mitre-siphon:main503c00321502
reactor-netty-http@1.1.7
1.2.8
1
ghcr.io/kafbat/kafka-ui:v1.2.0185da4ad3e88
reactor-netty-http@1.2.3
1.2.8
1
ghcr.io/privacyengineering/hawk-service:latestbfedf47bb5e0
reactor-netty-http@1.1.13
1.2.8
1
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
reactor-netty-http@1.0.45
1.2.8
1
ghcr.io/projectnessie/nessie:0.108.4c0f42874c810
reactor-netty-http@1.0.48
1.2.8
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
reactor-netty-http@1.0.26
1.2.8
1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:1.66.9138c8b82c398
reactor-netty-http@1.0.39
1.2.8
1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:latestf669a6eacf8c
reactor-netty-http@1.0.39
1.2.8
1
quay.io/evryfs/spring-boot-admin:2.7.1060950ef63764
reactor-netty-http@1.0.26
1.2.8
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
reactor-netty-http@1.1.13
1.2.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.