Reactor Netty
Monthly
HTTP/1.1 request pipelining in Reactor Netty causes unbounded memory growth, exposing Spring WebFlux applications to availability degradation or denial of service from unauthenticated remote clients. Three release trains are affected - 1.0.x through 1.0.52, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6 - giving this issue broad coverage across current and legacy Spring reactive deployments. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the low exploitation complexity warrants attention in deployments that expose Reactor Netty directly to the internet.
Reactor Netty HTTP Server incorrectly evaluates the remote client IP address in deployments where HAProxy PROXY Protocol support is enabled, potentially allowing network attackers to spoof their apparent source IP. Affected versions span the 1.0.x, 1.1.x/1.2.x, and 1.3.x branches. This flaw carries no confidentiality or availability impact per the CVSS vector, but can undermine IP-based access controls, rate limiting, audit logging, or allowlist/denylist enforcement that rely on the server's perception of the client IP. No public exploit code or CISA KEV listing is present at time of analysis.
Credential leakage in the Reactor Netty WebSocket client exposes authentication data when a WebSocket handshake is redirected to a different origin and the HTTP client has been explicitly configured to follow redirects. Affected release trains span Reactor Netty 1.0.x through 1.3.6, covering multiple active Spring ecosystem versions maintained by VMware. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the cross-origin credential forwarding is a direct confidentiality risk for any reactive Spring application operating with redirect-following enabled.
Exception detail leakage in Reactor Netty HTTP Server exposes internal error information across unrelated client requests when the server is configured with Brave Tracing. Affected versions span three distinct release lines - 1.0.x through 1.0.52, 1.1.x through 1.2.18, and 1.3.0 through 1.3.6 - making the exposure broad in terms of version footprint. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; real-world risk is bounded by the prerequisite Brave Tracing configuration.
DNS resolver isolation failure in Reactor Netty allows network-adjacent attackers to trigger incorrect DNS resolution by exploiting resolver state leakage across multiple concurrently configured HTTP clients. Affected versions span three release lines: 1.0.x through 1.0.52, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6. When an application instantiates multiple Reactor Netty clients with distinct DNS resolver configurations, a previously used resolver may be applied to a subsequent client, causing network requests to resolve hostnames through an unintended resolver. No public exploit identified at time of analysis.
Credential leakage in the Reactor Netty HTTP client exposes authentication material when following redirects that cross security boundaries from HTTPS to HTTP. Affected are all four supported release lines: 1.0.x through 1.0.51, 1.1.x through 1.1.35, 1.2.x through 1.2.17, and 1.3.x through 1.3.5. An attacker who controls or can influence a redirect response can cause the client to transmit credentials over an unencrypted channel, where they may be intercepted. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HTTP/1.1 request pipelining in Reactor Netty causes unbounded memory growth, exposing Spring WebFlux applications to availability degradation or denial of service from unauthenticated remote clients. Three release trains are affected - 1.0.x through 1.0.52, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6 - giving this issue broad coverage across current and legacy Spring reactive deployments. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the low exploitation complexity warrants attention in deployments that expose Reactor Netty directly to the internet.
Reactor Netty HTTP Server incorrectly evaluates the remote client IP address in deployments where HAProxy PROXY Protocol support is enabled, potentially allowing network attackers to spoof their apparent source IP. Affected versions span the 1.0.x, 1.1.x/1.2.x, and 1.3.x branches. This flaw carries no confidentiality or availability impact per the CVSS vector, but can undermine IP-based access controls, rate limiting, audit logging, or allowlist/denylist enforcement that rely on the server's perception of the client IP. No public exploit code or CISA KEV listing is present at time of analysis.
Credential leakage in the Reactor Netty WebSocket client exposes authentication data when a WebSocket handshake is redirected to a different origin and the HTTP client has been explicitly configured to follow redirects. Affected release trains span Reactor Netty 1.0.x through 1.3.6, covering multiple active Spring ecosystem versions maintained by VMware. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the cross-origin credential forwarding is a direct confidentiality risk for any reactive Spring application operating with redirect-following enabled.
Exception detail leakage in Reactor Netty HTTP Server exposes internal error information across unrelated client requests when the server is configured with Brave Tracing. Affected versions span three distinct release lines - 1.0.x through 1.0.52, 1.1.x through 1.2.18, and 1.3.0 through 1.3.6 - making the exposure broad in terms of version footprint. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; real-world risk is bounded by the prerequisite Brave Tracing configuration.
DNS resolver isolation failure in Reactor Netty allows network-adjacent attackers to trigger incorrect DNS resolution by exploiting resolver state leakage across multiple concurrently configured HTTP clients. Affected versions span three release lines: 1.0.x through 1.0.52, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6. When an application instantiates multiple Reactor Netty clients with distinct DNS resolver configurations, a previously used resolver may be applied to a subsequent client, causing network requests to resolve hostnames through an unintended resolver. No public exploit identified at time of analysis.
Credential leakage in the Reactor Netty HTTP client exposes authentication material when following redirects that cross security boundaries from HTTPS to HTTP. Affected are all four supported release lines: 1.0.x through 1.0.51, 1.1.x through 1.1.35, 1.2.x through 1.2.17, and 1.3.x through 1.3.5. An attacker who controls or can influence a redirect response can cause the client to transmit credentials over an unencrypted channel, where they may be intercepted. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.