TI-2023-16928 Aliases CVE-2023-34062 GHSA-xjhv-p3fv-x24r

Path traversal in Reactor Netty

MEDIUM 41CWE-22Published 2023-11-15 · Updated 2024-08-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01124 66th percentileScored 2026-11-07

Fix Partial Reactor Netty: 1.1.13, 1.0.39io.projectreactor.netty:reactor-netty-http (Maven): 1.1.13, 1.0.39Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Reactor Netty	1.1.0 to before 1.1.13; 1.0.0 to before 1.0.39; older unsupported versions	1.1.13, 1.0.39	Patch available	CNA
—	io.projectreactor.netty:reactor-netty-http (Maven)	1.1.0 to before 1.1.13	1.1.13	Patch available	GHSA-xjhv-p3fv-x24r
—	io.projectreactor.netty:reactor-netty-http (Maven)	1.0.0 to before 1.0.39	1.0.39	Patch available	GHSA-xjhv-p3fv-x24r

Reactor Netty Vendor— Affected 1.1.0 to before 1.1.13; 1.0.0 to before 1.0.39; older unsupported versions Fixed in 1.1.13, 1.0.39 Patch available CNA
io.projectreactor.netty:reactor-netty-http (Maven) Vendor— Affected 1.1.0 to before 1.1.13 Fixed in 1.1.13 Patch available GHSA-xjhv-p3fv-x24r
io.projectreactor.netty:reactor-netty-http (Maven) Vendor— Affected 1.0.0 to before 1.0.39 Fixed in 1.0.39 Patch available GHSA-xjhv-p3fv-x24r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:broadcom:reactor_netty::::::::	1.0.0 to before 1.0.39; 1.1.0 to before 1.1.13	Vulnerable	Broadcom

cpe:2.3:a:broadcom:reactor_netty:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.0.39; 1.1.0 to before 1.1.13 Vulnerable ·Broadcom

Remediation

Fix · CNA Reactor Netty Fixed in 1.1.13, 1.0.39
Fix · GHSA-xjhv-p3fv-x24r io.projectreactor.netty:reactor-netty-http (Maven) Fixed in 1.1.13 Advisory →
Fix · GHSA-xjhv-p3fv-x24r io.projectreactor.netty:reactor-netty-http (Maven) Fixed in 1.0.39 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Dev Spaces	Affected	No fix yet

Not affected: 7 products

Red Hat Fuse 7
Red Hat Integration Camel K 1
Red Hat JBoss Enterprise Application Platform 7
Red Hat JBoss Enterprise Application Platform 8
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat build of Apache Camel for Spring Boot 3
Red Hat build of Debezium 2

Timeline

2026-10-02 Threatist record created from CVE-2023-34062
2026-10-03 Alias added: GHSA-xjhv-p3fv-x24r

References

Advisory 2

Other 2

TI-2019-08442 Reactor Netty authentication leak in redirects CVSS 3.1HIGH 8.6
TI-2023-16920 Reactor Netty HTTP Server Metrics DoS Vulnerability CVSS 3.1HIGH 7.5
TI-2020-04449 DoS Via Malformed URL with Reactor Netty HTTP Server CVSS 3.1HIGH 7.5
TI-2026-35297 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses CVSS 3.1MEDIUM 5.3
TI-2026-35300 Reactor Netty WebSocket Client Leaks Credentials On Redirect CVSS 3.1MEDIUM 6.1
TI-2020-04450 Authentication Leak On Redirect With Reactor Netty HttpClient CVSS 3.1MEDIUM 5.9

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences