CVE-2019-11284 Reactor Netty authentication leak in redirects
Reactor Netty leaks authorization headers during redirects, allowing attackers to steal credentials for other servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11284?
CVE-2019-11284 is a medium-severity vulnerability in Pivotal Reactor Netty, published on 17 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Weakness: CWE-522
Which versions are affected by CVE-2019-11284?
2 open source packages ship an affected version, including io.projectreactor.netty:reactor-netty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.projectreactor.netty:reactor-netty Maven | All versions | 0.8.11 |
io.projectreactor.netty:reactor-netty Maven | All versions | 0.8.11 |
Products include Broadcom Reactor Netty.
How do I fix CVE-2019-11284?
Upgrade io.projectreactor.netty:reactor-netty to 0.8.11 or later.
Is CVE-2019-11284 being exploited?
There is no known exploitation of CVE-2019-11284 in the wild and no public exploit code.
Other vulnerabilities in Pivotal Reactor Netty
- CVE-2023-34062 In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack
- CVE-2020-5403 DoS Via Malformed URL with Reactor Netty HTTP Server
- CVE-2020-5404 Authentication Leak On Redirect With Reactor Netty HttpClient
- CVE-2026-47848 Reactor Netty WebSocket Client Leaks Credentials On Redirect
- CVE-2026-47844 Reactor Netty HTTP Server Leaks Exception Details
Sources
Also known as GHSA-j52r-xc68-q8f4.