DoS (Denial of Service) io.netty:netty-codec-http2 Dependency Vulnerability in Crowd Data Center and Server

This High severity DoS Denial of Service vulnerability was introduced in version 7.1.0 of Crowd Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N allows an unauthenticated attacker ...

Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in reactor-netty-http

Summary Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in reactor-netty-http Vulnerability Details CVEID:CVE-2025-22227 DESCRIPTION: In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen,...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.10.7 for Spring Boot release.

Red Hat build of Apache Camel 4.10.7 for Spring Boot patch release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

EUVD-2019-0710

Malware in sbrugna...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.9 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Security Bulletin: Vulnerabilities in Spring Cloud Gateway Server, Bouncy Castle, Reactor Netty HTTP Server, NPM and Apache Commons might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Spring Cloud Gateway Server, Bouncy Castle, Reactor Netty HTTP Server, NPM and Apache Commons. Vulnerabilities include forwarded headers from untrusted proxies, opening up a possibility of DNS poisoning,...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.ancf.lmos-router:benchmarks (>=0.2.0, <=0.28.0) +5536 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.2.7)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm 0.1.0...

io.github.mullerhai:storch-mcp_3 (0.1.0), io.projectreactor.netty:reactor-netty (>=1.3.0-m1, <=1.3.0-m4) +1 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.3.0-m1, <=1.3.0-m4)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.3.0-m1, =1.3.0-m1, =1.3.0-m1, =1.3.0-m4 Source cves: CVE-2025-22227 Source advisory: OSV:GHSA-4Q2V-9P7V-3V22...

io.github.mullerhai:storch-mcp_3 (0.1.0), io.projectreactor.netty:reactor-netty (>=1.3.0-m1, <=1.3.0-m4) +1 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.3.0-m1, <=1.3.0-m4)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.3.0-m1, =1.3.0-m1, =1.3.0-m1, =1.3.0-m4 Source cves: CVE-2025-22227 Source advisory: GHSA-4Q2V-9P7V-3V22...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.ancf.lmos-router:benchmarks (>=0.2.0, <=0.28.0) +5536 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.2.7)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm 0.1.0...

CVE-2025-22227

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.ancf.lmos-router:benchmarks (>=0.2.0, <=0.28.0) +5536 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.2.7)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm 0.1.0...

io.github.mullerhai:storch-mcp_3 (0.1.0), io.projectreactor.netty:reactor-netty (>=1.3.0-m1, <=1.3.0-m4) +1 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.3.0-m1, <=1.3.0-m4)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.3.0-m1, =1.3.0-m1, =1.3.0-m1, =1.3.0-m4 Source cves: CVE-2025-22227 Source advisory: MEND:CVE-2025-22227...

CVE-2025-22227: Exposure of Sensitive Information to an Unauthorized Actor

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects...

io.github.mullerhai:storch-mcp_3 (0.1.0), io.projectreactor.netty:reactor-netty (>=1.3.0-m1, <=1.3.0-m4) +1 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.3.0-m1, <=1.3.0-m4)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.3.0-m1, =1.3.0-m1, =1.3.0-m1, =1.3.0-m4 Source cves: CVE-2025-22227 Source advisory: SNYK:JAVA-IOPROJECTREACTORNETTY-10770514...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.ancf.lmos-router:benchmarks (>=0.2.0, <=0.28.0) +5536 more potentially affected by CVE-2025-22227 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.2.7)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm 0.1.0...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via handling of chained redirects. An attacker can cause the Reactor Netty HTTP client to leak credentials such as session cookies by intercepting initial HTTP/1...

netty-codec-http: Allocation of Resources Without Limits or Throttling

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...

CVE-2023-34054

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in...

CVE-2023-34054 Reactor Netty HTTP Server Metrics DoS Vulnerability

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in...