Pivotal Reactor Netty vulnerabilities

4 vulnerabilities

Known vulnerabilities in Pivotal Reactor Netty, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5CVE-2020-5404broadcomreactor_netty+2
EPSS score
0.65%
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.7.5CVE-2020-5403broadcomreactor_netty+2
EPSS score
1.15%
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.8.6CVE-2019-11284broadcomreactor_netty+2
EPSS score
0.89%
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.5.3CVE-2026-47874pivotalreactor_netty+1
EPSS score
0.40%
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier