Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Aug 26, 2026The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessiveCVE-2026-47874 · Other software · Spring · reported by security@vmware.comMedium 5.3
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled.CVE-2026-47845 · Other software · Spring · reported by security@vmware.comMedium 5.3
In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials.CVE-2026-47848 · Other software · Spring · reported by security@vmware.comMedium 6.1
In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests.CVE-2026-47844 · Other software · Spring · reported by security@vmware.comMedium 5.3
In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resCVE-2026-47843 · Other software · Spring · reported by security@vmware.comLow 3.7
In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials.CVE-2026-41715 · Other software · Spring · reported by security@vmware.comMedium 6.1
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials.CVE-2025-22227 · Other software · VMware · reported by security@vmware.comMedium 6.1
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023 In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP reCVE-2023-34054 · Other software · Spring · reported by security@vmware.comMedium 5.3
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted UCVE-2023-34062 · Other software · reactor_netty · reported by security@vmware.comHigh 7.5
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
- Product
- reactor_netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests.CVE-2022-31684 · Other software · Broadcom · reported by security@vmware.comMedium 4.3
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtanzu.vmware.comtanzu.vmware.com
Mar 3, 2020Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing CVE-2020-5403 · Other software · Pivotal · reported by security@pivotal.ioHigh 7.5
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2020The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak durCVE-2020-5404 · Other software · Pivotal · reported by security@pivotal.ioMedium 5.9
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2019Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones.CVE-2019-11284 · Other software · Pivotal · reported by security@pivotal.ioHigh 8.6
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
- Product
- Reactor Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.