Correct fix commit reference for GHSA-4q2v-9p7v-3v22 (CVE-2025-22227)

[anthonydahanne]

This advisory's commit reference points at an unrelated commit. This PR replaces it with the one that actually contains the fix, and adds the matching release tags. Only the references array changes.

The fix

The redirect logic lives in HttpClientConnect.java. Diffing it across the fix release gives every redirect-path change that shipped in 1.2.8:

$ git diff v1.2.7 v1.2.8 -- \
    reactor-netty-http/src/main/java/reactor/netty/http/client/HttpClientConnect.java

@@ -520,10 +520,10 @@   (constructor)
-				this.toURI = uriEndpointFactory.createUriEndpoint(uri, ...);
+				this.fromURI = this.toURI = uriEndpointFactory.createUriEndpoint(uri, ...);

@@ -676,9 +676,8 @@   (redirect)
-			fromURI = from;
 			toURI = toURITemp;

(plus one private → private static conversion, omitted). All of it comes from 8d882ffab7c4fa73dd03d3a3e35d2336dc865e52 — the only commit in v1.2.7..v1.2.8 touching HttpClientConnect.java or UriEndpointFactory.java.

Why those two lines are the fix: headers are stripped by the guard if (fromURI != null && !toURI.equals(fromURI)), and UriEndpoint.equals() compares only the remote address. Previously redirect() advanced fromURI to each preceding hop, so a second redirect to an already-seen host compared equal, the guard was skipped, and EXPECT, COOKIE, AUTHORIZATION, PROXY_AUTHORIZATION went to the target. The fix pins fromURI to the original request URI, so the comparison is always against the origin.

The commit is titled "Method can be made static" — the security changes rode along with a refactor, which is likely how it was missed.

The current reference

5228923 is "Ensure the HTTP/2 upgrade stream inherits the proper state from the original HTTP/1.1 connection" (#3838). It touches three H2 files, contains no header-removal code, and does not touch the redirect path.

It also didn't come from the CNA — the NVD record for CVE-2025-22227 (security@vmware.com) carries only the spring.io page; the commit link was added at curation time.

Release tags

git tag --contains 8d882ff includes both v1.2.8 and v1.3.0-M5 — exactly the two fixed events in this advisory. I've added both tags; happy to drop them if they read as duplicative.

modified, database_specific, affected, severity and CWE left untouched.

[Copilot]

Copilot review overview

🟢 Approval recommended

The referenced commit contains the redirect fix and is included in both linked releases.

Review effort: Balanced
Findings: None

What changed in this PR

Corrects GHSA-4q2v-9p7v-3v22 to reference the actual Reactor Netty redirect security fix.

Changes:

• Replaces the unrelated commit reference with the verified fix commit.
• Adds links to both matching fixed releases.

File	Description
GHSA-4q2v-9p7v-3v22.json	Updates fix and release references.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.