Description
An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.typesafe.play:play-ws_2.12 | >= 2.5.0, < 2.6.24 | 2.6.24 | GHSA-442g-gcg6-mhm4 |