Skip to content
OpenAdvisories

Product · Spring

Reactor Netty

7 known vulnerabilities.

Reactor Netty at a glance

Last 12 months
6
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 5 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202650
Jul 202600
Jun 202610
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 5.3
    CVE-2026-47874

    Reactor Netty HTTP Server Denial of Service With Pipelined Requests

    The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 an…

    Spring Reactor Netty
  • Medium 5.3
    CVE-2026-47845

    Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

    In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Nett…

    Spring Reactor Netty
  • Medium 6.1
    CVE-2026-47848

    Reactor Netty WebSocket Client Leaks Credentials On Redirect

    In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty …

    Spring Reactor Netty
  • Medium 5.3
    CVE-2026-47844

    Reactor Netty HTTP Server Leaks Exception Details

    In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.…

    Spring Reactor Netty
  • Low 3.7
    CVE-2026-47843

    Reactor Netty may incorrectly route traffic due to DNS resolver reuse

    In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

    Spring Reactor Netty
  • Medium 6.1
    CVE-2026-41715

    Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect

    In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Affected versions:…

    Spring Reactor Netty io.projectreactor.netty:reactor-netty Maven
  • Medium 5.3
    CVE-2023-34054

    Reactor Netty HTTP Server Metrics DoS Vulnerability

    In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerabl…

    Spring Reactor Netty io.projectreactor.netty:reactor-netty-core Maven