africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.ancf.lmos-router:benchmarks (>=0.2.0, <=0.28.0) +5553 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.2.7)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm 0.1.0...

io.github.mullerhai:storch-mcp_3 (0.1.0), io.projectreactor.netty:reactor-netty (>=1.3.0-m1, <=1.3.0-m4) +1 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.3.0-m1, <=1.3.0-m4)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.3.0-m1, =1.3.0-m1, =1.3.0-m1, =1.3.0-m4 Source cves: CVE-2025-22227 Source advisory: MEND:CVE-2025-22227...

CVE-2025-22227: Exposure of Sensitive Information to an Unauthorized Actor

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects...

io.github.mullerhai:storch-mcp_3 (0.1.0), io.projectreactor.netty:reactor-netty (>=1.3.0-m1, <=1.3.0-m4) +1 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.3.0-m1, <=1.3.0-m4)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.3.0-m1, =1.3.0-m1, =1.3.0-m1, =1.3.0-m4 Source cves: CVE-2025-22227 Source advisory: SNYK:JAVA-IOPROJECTREACTORNETTY-10770514...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via handling of chained redirects. An attacker can cause the Reactor Netty HTTP client to leak credentials such as session cookies by intercepting initial HTTP/1...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.ancf.lmos-router:benchmarks (>=0.2.0, <=0.28.0) +5553 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.2.7)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm 0.1.0...

netty-codec-http: Allocation of Resources Without Limits or Throttling

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...

CVE-2023-34054

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in...

CVE-2023-34054 Reactor Netty HTTP Server Metrics DoS Vulnerability

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in...

CVE-2023-34054: Undefined Security Weakness

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in...

ai.optfor:spring-openai-api (>=0.2.2, <=0.3.25), be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-azure-blob-out (2.12.0) +1024 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.1.0, <=1.1.12)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.1.0, =0.2.2, =0.14.0, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0 and more Source cves: CVE-2023-34062 Source advisory:...

ai.optfor:spring-openai-api (>=0.2.2, <=0.3.25), be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-azure-blob-out (2.12.0) +1024 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.1.0, <=1.1.12)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.1.0, =0.2.2, =0.14.0, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0 and more Source cves: CVE-2023-34062 Source advisory:...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.onehouse:lakeview (>=0.26.0, <=0.33.0) +2826 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.0.38)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.26.0, =0.26.0, =j8.2.4.0, =v0.3.12, =v0.3.10, =v0.3.12, =1.3, =3.1.242, =3.1.242, =3.1.242, =3.1.242, =3.1.496 and more Source cves: CVE-2023-34062 Source advisory: GHSA-XJHV-P3FV-X24R...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.onehouse:lakeview (>=0.26.0, <=0.33.0) +2826 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.0.38)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.26.0, =0.26.0, =j8.2.4.0, =v0.3.12, =v0.3.10, =v0.3.12, =1.3, =3.1.242, =3.1.242, =3.1.242, =3.1.242, =3.1.496 and more Source cves: CVE-2023-34062 Source advisory: OSV:GHSA-XJHV-P3FV-X24R...

CVE-2023-34062

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.onehouse:lakeview (>=0.26.0, <=0.33.0) +2826 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.0.38)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.26.0, =0.26.0, =j8.2.4.0, =v0.3.12, =v0.3.10, =v0.3.12, =1.3, =3.1.242, =3.1.242, =3.1.242, =3.1.242, =3.1.496 and more Source cves: CVE-2023-34062 Source advisory: MEND:CVE-2023-34062...

ai.optfor:spring-openai-api (>=0.2.2, <=0.3.25), be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-azure-blob-out (2.12.0) +1024 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.1.0, <=1.1.12)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.1.0, =0.2.2, =0.14.0, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0 and more Source cves: CVE-2023-34062 Source advisory:...

CVE-2023-34062: Improper Limitation of a Pathname to a Restricted Directory

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Netty HTTP response splitting (CVE-2022-41915)

Summary Potential security bypass vulnerability in Netty-CVE-2022-41915 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-41915 DESCRIPTION: Netty is vulnerable to HTTP response...

FreeBSD : cassandra3 -- multiple vulnerabilities (53caf29b-9180-11ed-acbe-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 53caf29b-9180-11ed-acbe-b42e991fc52e advisory. - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI...