Spring Reactor Netty
7 CVEs affecting Spring Reactor Netty. Latest disclosed: 2026-08-27. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47848 | Medium | 6.1 | 2026-08-26 | In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this… |
CVE-2026-41715 | Medium | 6.1 | 2026-06-09 | In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to… |
CVE-2026-47874 | Medium | 5.3 | 2026-08-27 | The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessiv… |
CVE-2026-47845 | Medium | 5.3 | 2026-08-27 | In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen… |
CVE-2026-47844 | Medium | 5.3 | 2026-08-26 | In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be conf… |
CVE-2023-34054 | Medium | 5.3 | 2023-11-28 | In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP r… |
CVE-2026-47843 | Low | 3.7 | 2026-08-26 | In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS re… |