CVE-2021-21271

Tendermint Core is an open source Byzantine Fault Tolerant BFT middleware that takes a state transition machine - written in any programming language - and securely replicates it on many machines. Tendermint Core v0.34.0 introduced a new way of handling evidence of misbehavior. As part of this, w...

CVE-2021-21271

Tendermint Core CVE-2021-21271 describes a DoS due to timestamp miscalculation of DuplicateVoteEvidence during consensus. In v0.34.0–v0.34.2, the consensus reactor formed DuplicateVoteEvidence using last-commit timestamps, which could differ across nodes for the same height since a block hadn’t f...

CVE-2021-21271: Uncontrolled Resource Consumption

Tendermint Core is an open source Byzantine Fault Tolerant BFT middleware that takes a state transition machine - written in any programming language - and securely replicates it on many machines. Tendermint Core v0.34.0 introduced a new way of handling evidence of misbehavior. As part of this, w...

CVE-2020-5303

CVE-2020-5303 affects Tendermint prior to 0.33.3, 0.32.10 and 0.31.12. The issues include a denial-of-service risk from unconstrained P2P connection attempts that allocates memory per connection, potentially causing temporary spikes and OOM, and a memory leak where activeIDs are not reclaimed aft...

PT-2020-18392

Name of the Vulnerable Software and Affected Versions Tendermint versions prior to 0.33.3 Tendermint versions prior to 0.32.10 Tendermint versions prior to 0.31.12 Description Tendermint has a denial-of-service vulnerability due to not limiting the number of P2P connection requests, which can lea...

CVE-2020-5403

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response...

CVE-2020-5403

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response...

Code injection

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response...

CVE-2020-5403 DoS Via Malformed URL with Reactor Netty HTTP Server

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response...

CVE-2020-5403

CVE-2020-5403 affects Reactor Netty HttpServer, specifically versions 0.9.3 and 0.9.4. The root cause is an URI syntax handling flaw that causes the connection to close prematurely due to a URISyntaxException, instead of returning a 400 Bad Request. This behavior can enable a DoS via malformed UR...

CVE-2020-5403

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response...

CVE-2020-5404

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirect...

CVE-2020-5404

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirect...

Buffer overflow

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirect...

CVE-2020-5404 Authentication Leak On Redirect With Reactor Netty HttpClient

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirect...

CVE-2020-5404

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirect...

CVE-2020-5404

CVE-2020-5404 affects Reactor Netty’s HttpClient (versions 0.9.x before 0.9.5 and 0.8.x before 0.8.16). The issue arises when the HttpClient is explicitly configured to follow redirects, which may cause a credentials leak during a redirect to a different domain. Impact is credential leakage; expl...

CVE-2020-5403: Improper Input Validation

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response...

PT-2020-18459 · Reactor Netty · Reactor Netty Http Server

Name of the Vulnerable Software and Affected Versions: Reactor Netty HttpServer versions 0.9.3 through 0.9.4 Description: The issue is related to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response. Recommendations: For versions 0.9.3 and...

CVE-2020-5404: Insufficiently Protected Credentials

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirect...