Maven package
io.projectreactor.netty/reactor-netty-http
pkg:maven/io.projectreactor.netty/reactor-netty-http
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-22227 | Med | 6.1 | >= 1.3.0-M1, < 1.3.0-M5 | 1.3.0-M5 | Jul 16, 2025 | In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. | |
| CVE-2023-34062 | — | >= 1.1.0, < 1.1.13 | 1.1.13 | Nov 15, 2023 | In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Serv | ||
| CVE-2022-31684 | — | >= 1.0.11, < 1.0.24 | 1.0.24 | Oct 19, 2022 | Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is | ||
| CVE-2020-5403 | — | >= 0.9.3, < 0.9.5 | 0.9.5 | Mar 3, 2020 | Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response. | ||
| CVE-2020-5404 | — | >= 0.9.0, < 0.9.5 | 0.9.5 | Mar 3, 2020 | The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured t |
- affected >= 1.3.0-M1, < 1.3.0-M5fixed 1.3.0-M5
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
- CVE-2023-34062Nov 15, 2023affected >= 1.1.0, < 1.1.13fixed 1.1.13
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Serv
- CVE-2022-31684Oct 19, 2022affected >= 1.0.11, < 1.0.24fixed 1.0.24
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is
- CVE-2020-5403Mar 3, 2020affected >= 0.9.3, < 0.9.5fixed 0.9.5
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
- CVE-2020-5404Mar 3, 2020affected >= 0.9.0, < 0.9.5fixed 0.9.5
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured t