Sensitive information in log files in Reactor Netty
Priority LOW 21CWE-532Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 2 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.
Summary
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00771 55th percentileScored 2026-11-07
Fix Partial io.projectreactor.netty:reactor-netty-http (Maven): 1.0.24Red Hat: 2 advisoriesRed Hat: 2 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Reactor Netty | Reactor Netty 1.0.11 to 1.0.23 | — | No fix listed | CNA |
| — | io.projectreactor.netty:reactor-netty-http (Maven) | 1.0.11 to before 1.0.24 | 1.0.24 | Patch available | GHSA-7w4x-4h67-pgmv |
- Reactor Netty Vendor— Affected Reactor Netty 1.0.11 to 1.0.23 Fixed in — No fix listed CNA
- io.projectreactor.netty:reactor-netty-http (Maven) Vendor— Affected 1.0.11 to before 1.0.24 Fixed in 1.0.24 Patch available GHSA-7w4x-4h67-pgmv
Remediation
- Fix · GHSA-7w4x-4h67-pgmv io.projectreactor.netty:reactor-netty-http (Maven) Fixed in 1.0.24 Advisory →
Red Hat 2 advisories
- RHSA-2023:4612 Released 2023-08-16 · Red Hat rating ImportantRed Hat support for Spring Boot 2.7.13 security update
- Red Hat support for Spring Boot 2.7.13
- RHSA-2022:8902 Released 2022-12-08 · Red Hat rating ModerateRed Hat Camel for Spring Boot 3.18.3 release and security update
- RHINT Camel-Springboot 3.18.3
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| Red Hat support for Spring Boot | Affected | No fix yet |
| RHINT Camel-Springboot 3.18.3 | Fixed | RHSA-2022:8902 |
| Red Hat support for Spring Boot 2.7.13 | Fixed | RHSA-2023:4612 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31684
- 2026-10-03 Alias added: GHSA-7w4x-4h67-pgmv
- 2026-10-11 EPSS moved to the 50th–90th percentile
References
More Broadcom Reactor Netty vulnerabilities
- TI-2023-16928 Path traversal in Reactor Netty CVSS 3.1HIGH 7.5
- TI-2019-08442 Reactor Netty authentication leak in redirects CVSS 3.1HIGH 8.6
- TI-2023-16920 Reactor Netty HTTP Server Metrics DoS Vulnerability CVSS 3.1HIGH 7.5
- TI-2020-04449 DoS Via Malformed URL with Reactor Netty HTTP Server CVSS 3.1HIGH 7.5
- TI-2026-35297 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses CVSS 3.1MEDIUM 5.3
- TI-2026-35300 Reactor Netty WebSocket Client Leaks Credentials On Redirect CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-31684 · CVE Program
- CVE-2022-31684 · NVD
- FIRST EPSS
- GHSA-7w4x-4h67-pgmv · GitHub Advisory Database · CC BY 4.0
- CVE-2022-31684 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences