Broadcom Reactor Netty vulnerabilities

10 CVEs affecting Broadcom Reactor Netty, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47845, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-5403, published 2020-03-03. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
CVE-2023-34062, published 2023-11-15. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory…
CVE-2023-34054, published 2023-11-28. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a…
CVE-2019-11284, published 2019-10-17. High severity, CVSS 8.6. EPSS: 0.9% chance of exploitation in the next 30 days. Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different…
CVE-2022-31684, published 2022-10-19. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to…
CVE-2020-5404, published 2020-03-03. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain.…
CVE-2026-47845, published 2026-08-27. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to…
CVE-2026-47848, published 2026-08-26. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have…
CVE-2026-47843, published 2026-08-26. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 -…
CVE-2026-47844, published 2026-08-26. Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days. In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty…