Broadcom Reactor Netty

Reactor Netty authentication leak in redirects

DoS Via Malformed URL with Reactor Netty HTTP Server

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.

Reactor Netty HTTP Server Metrics DoS Vulnerability

Authentication Leak On Redirect With Reactor Netty HttpClient

Reactor Netty WebSocket Client Leaks Credentials On Redirect

Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

Reactor Netty HTTP Server Leaks Exception Details

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

Reactor Netty may incorrectly route traffic due to DNS resolver reuse