CVE-2022-31684

MediumCVSS 4.3

Published: 19/10/2022(UTC)Updated: 04/09/2026(UTC)Translated: 05/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.65%

48th percentile - higher than 48% of all known CVEs

Summary

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

Risk Assessment

Leakage of access tokens into logs could allow unauthorized access to systems if logs are accessible to unintended parties.

Recommendation

Upgrade Reactor Netty to a version later than 1.0.23 to prevent header logging in invalid requests. Additionally, restrict access to server logs and review them regularly.

Other vulnerabilities in Reactor Netty HTTP Server

CVE-2023-34054Medium
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS