Filtered by vendor Pivotal Subscriptions
Filtered by product Reactor Netty Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-34054 1 Pivotal 1 Reactor Netty 2023-12-04 7.5 High
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.
CVE-2023-34062 1 Pivotal 1 Reactor Netty 2023-11-21 7.5 High
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
CVE-2022-31684 1 Pivotal 1 Reactor Netty 2022-10-21 4.3 Medium
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
CVE-2020-5403 1 Pivotal 1 Reactor Netty 2022-09-20 7.5 High
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
CVE-2020-5404 1 Pivotal 1 Reactor Netty 2021-07-07 5.9 Medium
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
CVE-2019-11284 1 Pivotal 1 Reactor Netty 2019-10-23 8.6 High
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.