Invalid HTTP requests in Reactor Netty HTTP Server may reveal access tokens

MEDIO 4.3CVE-2022-31684 · GHSA-7w4x-4h67-pgmv · Published 19/10/2022 · updated 04/09/2026

In breve

CVE-2022-31684 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda io.projectreactor.netty:reactor-netty-http, reactor netty (broadcom).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.77%, superiore al 55.5% delle vulnerabilità.
Correzione: aggiornare a 1.0.24 o successiva.

Package	Affected versions	Patched versions
io.projectreactor.netty:reactor-netty-http Maven	`≥ 1.0.11, < 1.0.24`	`1.0.24`
reactor netty broadcom	`≥ 1.0.11, ≤ 1.0.23`	No fix yet

Description

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may request log headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

NVD description

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

References

nvd.nist.gov/vuln/detail/CVE-2022-31684 · ADVISORY
search.maven.org/artifact/io.projectreactor.netty/reactor-netty-http · PACKAGE
tanzu.vmware.com/security/cve-2022-31684 · WEB

Altre vulnerabilità di io.projectreactor.netty:reactor-netty-http

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

io.projectreactor.netty:reactor-netty-http

Maven

≥ 1.0.11, < 1.0.24

1.0.24

reactor netty

broadcom

≥ 1.0.11, ≤ 1.0.23

No fix yet

Description

NVD description

Altre vulnerabilità di io.projectreactor.netty:reactor-netty-http

Vedi tutto →