[Aikido] Fix 9 security issues in reactor-netty-http, reactor-core, spring-beans and 7 more

[aikido-autofix]

Upgrade dependencies to fix credential leakage in WebSocket redirects, IP address misidentification with HAProxy, HTTP pipelining DoS, and stream processing hangs in backpressure scenarios.

⚠️ Breaking changes analysis not available for: org.jetbrains.kotlin:kotlin-stdlib

✅ No breaking changes for: io.projectreactor.netty:reactor-netty-http, io.projectreactor:reactor-core, org.springframework:spring-beans, io.projectreactor.netty:reactor-netty-core, org.springframework:spring-core, org.springframework:spring-webmvc, org.springframework:spring-web, org.springframework:spring-expression, org.springframework:spring-context

✅ 9 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-980617	MEDIUM	[reactor-netty-http] A WebSocket handshake redirect to a different origin can leak credentials when the HTTP client is configured to follow redirects, allowing a remote attacker to intercept credentials meant for the original host.
AIKIDO-2026-718872	MEDIUM	[reactor-netty-http] A vulnerability allows incorrect evaluation of remote IP addresses when HAProxy Protocol is enabled, potentially leading to access-control bypass or incorrect logging decisions. An attacker could spoof their client identity by manipulating proxy protocol data.
AIKIDO-2026-556582	LOW	[reactor-netty-http] A remote attacker can cause excessive memory consumption by sending HTTP/1.1 pipelined requests on a single connection, leading to denial of service and reduced server availability. The vulnerability allows degradation or exhaustion of server resources through memory exhaustion.
AIKIDO-2026-268979	MEDIUM	[reactor-core] A 20-bit index wrap in Flux.windowTimeout with fair backpressure can cause the operator to hang indefinitely on long-lived streams, allowing attackers to exhaust resources through denial of service.
AIKIDO-2026-224455	MEDIUM	[reactor-core] A race condition in Flux.bufferTimeout with fair backpressure can cause the stream to hang when upstream items arrive during buffer flush, leaving items unprocessed. An attacker can exploit this to exhaust subscriptions through denial of service.
AIKIDO-2026-349640	MEDIUM	[spring-beans] A data binding vulnerability allows untrusted property paths to trigger unbounded memory allocation through lists that grow on access, bypassing the autoGrowCollectionLimit protection and potentially causing denial of service through memory exhaustion.
AIKIDO-2026-550292	MEDIUM	[kotlin-stdlib] In JetBrains Kotlin, a vulnerable Java API is used for temporary file and folder creation. An attacker is able to read data from such files and list directories due to insecure permissions.
AIKIDO-2026-592409	LOW	[reactor-netty-core] A DNS resolver configuration can be incorrectly reused across multiple dynamically created clients with different resolver settings, causing traffic to be routed to unintended destinations. This allows an attacker to perform DNS hijacking or traffic redirection attacks.
AIKIDO-2026-620042	LOW	[spring-beans] A vulnerability allows CR/LF characters from untrusted file names to be embedded in HTTP response headers or multipart content, potentially enabling HTTP response splitting attacks. The issue is mitigated by sanitizing file names used in Content-Disposition headers.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-18895

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!