CVE-2022-31684

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled...

CVE-2022-31684: Insertion of Sensitive Information into Log File

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled...

PT-2022-20889

Name of the Vulnerable Software and Affected Versions Reactor Netty HTTP Server versions 1.0.11 through 1.0.23 Description The issue affects the logging of request headers in cases of invalid HTTP requests. When logging at WARN level is enabled, the logged headers may reveal valid access tokens t...

netty: possible request smuggling in HTTP/2 due missing validation

In Netty io.netty:netty-codec-http2 before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by Http2MultiplexHandler as it is propagated up. This is fine as long as the...

org.apache.camel.kafkaconnector:camel-netty-http-kafka-connector (0.1.0), org.apache.camel.kafkaconnector:camel-netty-kafka-connector (0.1.0) +19 more potentially affected by CVE-2020-11973 via org.apache.camel:camel-netty (>=3.0.0, <=3.1.0)

org.apache.camel:camel-netty MAVEN version =3.0.0, =1.0.0-m1, =1.0.0-m3, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =3.0.0, =3.1.0 and more Source cves: CVE-2020-11973https://vulners.com/c...

CVE-2020-5403 DoS Via Malformed URL with Reactor Netty HTTP Server

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response...

CVE-2020-7238

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace such as a spaceTransfer-Encoding:chunked line and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869...

CVE-2019-16869

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers such as a "Transfer-Encoding : chunked" line, which leads to HTTP request smuggling...