Reactor Netty (Broadcom) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 224 known versions, newest CVE from 2026-08-26. Vendor: Broadcom.
CVEs of Reactor Netty
- CVE-2026-47845 - CVSS 5.3 (medium), 2026-08-26: In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen,…
- CVE-2026-47848 - CVSS 6.1 (medium), 2026-08-26: In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for…
- CVE-2026-47844 - CVSS 5.3 (medium), 2026-08-26: In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be…
- CVE-2026-47843 - CVSS 3.7 (low), 2026-08-26: In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS…
- CVE-2023-34054 - CVSS 7.5 (high), 2023-11-28: In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP…
- CVE-2023-34062 - CVSS 7.5 (high), 2023-11-15: In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted…
- CVE-2022-31684 - CVSS 4.3 (medium), 2022-10-19: Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid…
- CVE-2020-5403 - CVSS 7.5 (high), 2020-03-03: Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of…
- CVE-2020-5404 - CVSS 6.5 (medium), 2020-03-03: The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak…
- CVE-2019-11284 - CVSS 8.6 (high), 2019-10-17: Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may…
