StackRadar

CVE-2025-22227

Medium

Advisory

Published 16 Jul 2025In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
95
of 17,781 indexed, latest versions
Container images
82
deployed by those charts
Fix available
1 of 1
affected package

Reactor Netty HTTP is vulnerable to credential leaks during chained redirects

Carried by container images the latest versions of 95 of 17,781 indexed charts deploy, on 82 images.

Affected packageAffected versionsFixed inImages
reactor-netty-httpmaven1.0.1, 1.0.4, 1.0.7, 1.0.11+33 more1.2.882
OSV records
GHSA-4q2v-9p7v-3v22

Charts affected

95 by stars
ChartLatestAffected imagesRadar Score
eoloplanteoloplant1.0.01 of 7See more

eoloplant eoloplant 1.0.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.239fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

27,537
eoloplantseoloplants-urjcVerified publisher0.1.01 of 7See more

eoloplants eoloplants-urjc 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

27,721
servereoloserverVerified publisher0.1.01 of 7See more

server eoloserver 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

32,205
dshackleethereum-helm-chartsVerified publisher0.1.91 of 2See more

dshackle ethereum-helm-charts 0.1.9

1 of the 2 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.14.0126f0ae0b388
reactor-netty-http@1.0.11
1.2.8

Open the chart page →

2,021
spring-boot-adminevryfs-ossVerified publisher0.1.101 of 1See more

spring-boot-admin evryfs-oss 0.1.10

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
quay.io/evryfs/spring-boot-admin:2.7.1060950ef63764
reactor-netty-http@1.0.26
1.2.8

Open the chart page →

5,998
scorpio-brokerfiware0.3.39 of 10See more

scorpio-broker fiware 0.3.3

9 of the 10 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
scorpiobroker/scorpio:RegistrySubscriptionManager_2.1.001e11d800459
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:eureka-server_2.1.03f05a113a4be
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:AtContextServer_2.1.05073ceef2fa0
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:gateway_2.1.062dae3dd0eeb
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:RegistryManager_2.1.0a2cfcf0947fd
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:QueryManager_2.1.0b742a53b2803
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:HistoryManager_2.1.0b7fe27a06ff5
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:SubscriptionManager_2.1.0e08036670d66
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:EntityManager_2.1.0f02e8a429a08
reactor-netty-http@1.0.13
1.2.8

Open the chart page →

55,600
scorpiobrokerfiware0.1.29 of 10See more

scorpiobroker fiware 0.1.2

9 of the 10 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
scorpiobroker/scorpio:RegistrySubscriptionManager_2.1.001e11d800459
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:eureka-server_2.1.03f05a113a4be
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:AtContextServer_2.1.05073ceef2fa0
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:gateway_2.1.062dae3dd0eeb
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:RegistryManager_2.1.0a2cfcf0947fd
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:QueryManager_2.1.0b742a53b2803
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:HistoryManager_2.1.0b7fe27a06ff5
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:SubscriptionManager_2.1.0e08036670d66
reactor-netty-http@1.0.13
1.2.8
scorpiobroker/scorpio:EntityManager_2.1.0f02e8a429a08
reactor-netty-http@1.0.13
1.2.8

Open the chart page →

55,600
scorpio-broker-aaiofiware0.4.151 of 1See more

scorpio-broker-aaio fiware 0.4.15

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
scorpiobroker/scorpio:scorpio-aaio_2.1.0db55012043df
reactor-netty-http@1.0.13
1.2.8

Open the chart page →

5,286
druidhelmforgeVerified publisher1.3.61 of 4See more

druid helmforge 1.3.6

1 of the 4 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
reactor-netty-http@1.0.48
1.2.8

Open the chart page →

8,541
elasticsearchhelmforgeVerified publisher1.1.81 of 2See more

elasticsearch helmforge 1.1.8

1 of the 2 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.38d09295845fe
reactor-netty-http@1.0.45
1.2.8

Open the chart page →

280
kibanahelmforgeVerified publisher1.1.71 of 3See more

kibana helmforge 1.1.7

1 of the 3 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.19656a9ca03f8
reactor-netty-http@1.0.45
1.2.8

Open the chart page →

341
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
openbas/platform:2.0.5d986d80b0a75
reactor-netty-http@1.1.25
1.2.8

Open the chart page →

25,017
eoloplanthttpd-eoloplant0.1.01 of 7See more

eoloplant httpd-eoloplant 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

32,205
prometheushuangchengwu-helm-chart0.1.01 of 3See more

prometheus huangchengwu-helm-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
apache/skywalking-ui:9.2.0295f1dc87d98
reactor-netty-http@1.0.18
1.2.8

Open the chart page →

16,401
skywalking-v1huangchengwu-helm-chart0.1.01 of 4See more

skywalking-v1 huangchengwu-helm-chart 0.1.0

1 of the 4 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
apache/skywalking-ui:8.9.180530f0308a5
reactor-netty-http@1.0.7
1.2.8

Open the chart page →

20,650
eoloserverihuertas2021-vmartinp2021-helm0.1.01 of 7See more

eoloserver ihuertas2021-vmartinp2021-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

27,721
daveit-at-mOfficialVerified publisher0.2.151 of 11See more

dave it-at-m 0.2.15

1 of the 11 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
reactor-netty-http@1.0.45
1.2.8

Open the chart page →

15,089
komgalinkding0.2.31 of 1See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
gotson/komga:1.22.0ba892ab3e082
reactor-netty-http@1.2.0
1.2.8

Open the chart page →

3,131
elastictranscoderluiscajl0.46.01 of 4See more

elastictranscoder luiscajl 0.46.0

1 of the 4 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
elastictranscoder/media-storage:f6d861a026208b8c2359
reactor-netty-http@1.0.7
1.2.8

Open the chart page →

58,160
torznab-atomohdluiscajl0.0.31 of 1See more

torznab-atomohd luiscajl 0.0.3

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
lavandadelpatio/torznab-atomohd:latest214eaef5444c
reactor-netty-http@1.1.5
1.2.8

Open the chart page →

3,290
eoloplantmca-eoloplaner0.1.01 of 7See more

eoloplant mca-eoloplaner 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
hugohg34/toposervice:0.0.2812a03b3f274
reactor-netty-http@1.0.13
1.2.8

Open the chart page →

29,588
elasticmicroboxlabs0.3.01 of 1See more

elastic microboxlabs 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
library/elasticsearch:8.17.32cc40b15dff8
reactor-netty-http@1.0.45
1.2.8

Open the chart page →

4,257
resource-processormicroservices-learningVerified publisher1.2.01 of 1See more

resource-processor microservices-learning 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
reactor-netty-http@1.1.11
1.2.8

Open the chart page →

3,683
resource-servicemicroservices-learningVerified publisher1.5.01 of 2See more

resource-service microservices-learning 1.5.0

1 of the 2 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-service:latest13ad9bb170a0
reactor-netty-http@1.1.11
1.2.8

Open the chart page →

5,129
mitre-siphonmitre-siphon0.2.91 of 4See more

mitre-siphon mitre-siphon 0.2.9

1 of the 4 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/mitre-siphon:main503c00321502
reactor-netty-http@1.1.7
1.2.8

Open the chart page →

3,083
Practica_4_helmmy-heml-appVerified publisher0.1.01 of 7See more

Practica_4_helm my-heml-app 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

27,721
logic-ms-helm-chartnotesprojectchart0.1.01 of 2See more

logic-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
vlebediantsev/logic-ms:latestdf8bf38c535b
reactor-netty-http@1.0.20
1.2.8

Open the chart page →

6,852
smsf-dispatcheropenshift1.0.41 of 1See more

smsf-dispatcher openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
gurolakman/smsf-dispatcher:1.0.46537e8ed8de8
reactor-netty-http@1.0.17
1.2.8

Open the chart page →

11,738
p4p40.1.01 of 7See more

p4 p4 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.239fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

27,537
Practica_4_helmpr04helm0.1.01 of 7See more

Practica_4_helm pr04helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
reactor-netty-http@1.1.0
1.2.8

Open the chart page →

27,558
practica-helmpractica-helm0.1.01 of 7See more

practica-helm practica-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
slagattollas/toposervice-practica:latestdc63973dae0d
reactor-netty-http@1.0.1
1.2.8

Open the chart page →

28,484
rada-platformrada-platform0.1.02 of 7See more

rada-platform rada-platform 0.1.0

2 of the 7 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
trinodb/trino:45038c6f24ab1a4
reactor-netty-http@1.0.43
1.2.8
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
reactor-netty-http@1.0.45
1.2.8

Open the chart page →

21,211
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
reactor-netty-http@1.0.39
1.2.8

Open the chart page →

5,269
authentication-serviceredestroyder0.2.21 of 1See more

authentication-service redestroyder 0.2.2

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
redestroyder/authorization-service:0.0.1740364a619fd
reactor-netty-http@1.0.15
1.2.8

Open the chart page →

2,583
business-serviceredestroyder0.2.11 of 1See more

business-service redestroyder 0.2.1

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
redestroyder/business-service:0.0.1db03499a0726
reactor-netty-http@1.0.15
1.2.8

Open the chart page →

2,600
fmtok8s-conference-chartsalaboy0.1.41 of 6See more

fmtok8s-conference-chart salaboy 0.1.4

1 of the 6 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
ghcr.io/salaboy/fmtok8s-frontend:v0.1.103fd01b4f56e
reactor-netty-http@1.0.19
1.2.8

Open the chart page →

16,101
fmtok8s-frontendsalaboy0.1.31 of 1See more

fmtok8s-frontend salaboy 0.1.3

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
ghcr.io/salaboy/fmtok8s-frontend:v0.1.103fd01b4f56e
reactor-netty-http@1.0.19
1.2.8

Open the chart page →

8,033
kafkasb-helm-charts0.3.01 of 2See more

kafka sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
provectuslabs/kafka-ui:latest8f2ff02d64b0
reactor-netty-http@1.1.10
1.2.8

Open the chart page →

1,597
shenyushenyu0.6.31 of 2See more

shenyu shenyu 0.6.3

1 of the 2 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.5.11bd5756f6273
reactor-netty-http@1.0.19
1.2.8

Open the chart page →

8,804
trinostatcan1.23.41 of 2See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
trinodb/trino:405ee80ab5eeab2
reactor-netty-http@1.0.14
1.2.8

Open the chart page →

13,767
netforge-besvtechVerified publisher0.0.21 of 3See more

netforge-be svtech 0.0.2

1 of the 3 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
conductoross/conductor:3.31.09fba127693e6
reactor-netty-http@1.1.29
1.2.8

Open the chart page →

4,674
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
reactor-netty-http@1.0.15
1.2.8

Open the chart page →

14,364
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
reactor-netty-http@1.0.15
1.2.8

Open the chart page →

28,605
elasticsearchwiremindVerified publisher8.19.01 of 1See more

elasticsearch wiremind 8.19.0

1 of the 1 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
library/elasticsearch:8.19.1289729a95066a
reactor-netty-http@1.0.45
1.2.8

Open the chart page →

2,191
zahori-serverzahoriVerified publisher1.0.11 of 2See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2025-22227.

Container imageDigestPackageFixed in
zahoriaut/zahori-server:0.1.17b2de13916f3e
reactor-netty-http@1.0.27
1.2.8

Open the chart page →

5,846

Container images carrying it

82 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/elasticsearch:8.15.0310b9fc03b06
reactor-netty-http@1.0.39
1.2.8
1
library/elasticsearch:9.5.38d09295845fe
reactor-netty-http@1.0.45
1.2.8
1
library/elasticsearch:9.5.19656a9ca03f8
reactor-netty-http@1.0.45
1.2.8
1
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
reactor-netty-http@1.1.11
1.2.8
1
maksimkavalenka/microservices-learning.resource-service:latest13ad9bb170a0
reactor-netty-http@1.1.11
1.2.8
1
openbas/platform:2.0.5d986d80b0a75
reactor-netty-http@1.1.25
1.2.8
1
redestroyder/authorization-service:0.0.1740364a619fd
reactor-netty-http@1.0.15
1.2.8
1
redestroyder/business-service:0.0.1db03499a0726
reactor-netty-http@1.0.15
1.2.8
1
scorpiobroker/scorpio:scorpio-aaio_2.1.0db55012043df
reactor-netty-http@1.0.13
1.2.8
1
slagattollas/toposervice-practica:latestdc63973dae0d
reactor-netty-http@1.0.1
1.2.8
1
stardog/stardog:latest2714e5c4b3c1
reactor-netty-http@1.0.48
1.2.8
1
structurizr/onpremises:2025.11.094b5ffb5119c8
reactor-netty-http@1.0.48
1.2.8
1
thmmniii/fbs-core:v1.27.15438517d9fc2
reactor-netty-http@1.0.32
1.2.8
1
treskon/portrait:DEV-latest88e813f22347
reactor-netty-http@1.1.24
1.2.8
1
trinodb/trino:45038c6f24ab1a4
reactor-netty-http@1.0.43
1.2.8
1
trinodb/trino:405ee80ab5eeab2
reactor-netty-http@1.0.14
1.2.8
1
vitalii1992/api-gateway-service:latestaabe6ac39356
reactor-netty-http@1.1.7
1.2.8
1
vlebediantsev/logic-ms:latestdf8bf38c535b
reactor-netty-http@1.0.20
1.2.8
1
vrijbrp/haal-centraal-brp-bevragen:develop5c770c2ae48c
reactor-netty-http@1.0.31
1.2.8
1
zahoriaut/zahori-server:0.1.17b2de13916f3e
reactor-netty-http@1.0.27
1.2.8
1
zbalogh/reservation-api-server:1.0.97c247e399a1f
reactor-netty-http@1.0.23
1.2.8
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
reactor-netty-http@1.1.9
1.2.8
1
ghcr.io/curium-rocks/mitre-siphon:main503c00321502
reactor-netty-http@1.1.7
1.2.8
1
ghcr.io/kafbat/kafka-ui:v1.2.0185da4ad3e88
reactor-netty-http@1.2.3
1.2.8
1
ghcr.io/privacyengineering/hawk-service:latestbfedf47bb5e0
reactor-netty-http@1.1.13
1.2.8
1
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
reactor-netty-http@1.0.45
1.2.8
1
ghcr.io/projectnessie/nessie:0.108.4c0f42874c810
reactor-netty-http@1.0.48
1.2.8
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
reactor-netty-http@1.0.26
1.2.8
1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:1.66.9138c8b82c398
reactor-netty-http@1.0.39
1.2.8
1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:latestf669a6eacf8c
reactor-netty-http@1.0.39
1.2.8
1
quay.io/evryfs/spring-boot-admin:2.7.1060950ef63764
reactor-netty-http@1.0.26
1.2.8
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
reactor-netty-http@1.1.13
1.2.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.