GitHub Advisoryadvisory · Maven

GHSA-7w4x-4h67-pgmv Invalid HTTP requests in Reactor Netty HTTP Server may reveal access tokens

MEDIUM Published 2022-10-20 Modified 2025-05-09 Official page ↗
Aliases
CVE-2022-31684
Ecosystem
Maven
Packages
io.projectreactor.netty:reactor-netty-http
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-532
Reviewed
2022-10-20

Affected packages

• Maven io.projectreactor.netty:reactor-netty-http: >= 1.0.11, < 1.0.24 → fixed in 1.0.24

Description

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may request log headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

Related

Alias · CVE (1)

  • CVE-2022-31684 Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References