CVE-2022-31684
Invalid HTTP requests in Reactor Netty HTTP Server may reveal access tokens
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
- Record
CVE-2022-31684- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
CVE List
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
- Record
CVE-2022-31684- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
EUVDEUVD-2022-7053
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
- Record
EUVD-2022-7053- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7w4x-4h67-pgmv
Invalid HTTP requests in Reactor Netty HTTP Server may reveal access tokens
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may request log headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
- Record
GHSA-7w4x-4h67-pgmv- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-532
- Updated
- 2026-11-02
OSV
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
- Record
CVE-2022-31684- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-7w4x-4h67-pgmv
Invalid HTTP requests in Reactor Netty HTTP Server may reveal access tokens
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may request log headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
- Record
GHSA-7w4x-4h67-pgmv- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-532
- Updated
- 2026-11-02
OSVCLSA-2026-1768435721 No score
TuxCare security update for io.projectreactor.netty (4 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 4 CVEs. Fixed in 1.0.23-tuxcare.1.
- Record
CLSA-2026-1768435721- Updated
- 2026-11-02
OSVCLSA-2026-1793619094 No score
TuxCare security update for io.projectreactor.netty (4 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 4 CVEs. Fixed in 1.0.18-tuxcare.1.
- Record
CLSA-2026-1793619094- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.projectreactor.netty:reactor-netty-httpMaven |
1.0.11 up to 1.0.24 | 1.0.24 |
io.projectreactor.netty:reactor-netty-coreTuxCare:Maven From an advisory covering 4 CVEs |
1.0.23 up to 1.0.23-tuxcare.1 | 1.0.23-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 4 CVEs |
1.0.23 up to 1.0.23-tuxcare.1 | 1.0.23-tuxcare.1 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven From an advisory covering 4 CVEs |
1.0.18 up to 1.0.18-tuxcare.1 | 1.0.18-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 4 CVEs |
1.0.18 up to 1.0.18-tuxcare.1 | 1.0.18-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpMaven |
1.0.11 up to 1.0.24, plus listed versions 1.0.121.0.131.0.141.0.151.0.16 Show 7 moreShow less1.0.171.0.181.0.191.0.201.0.211.0.221.0.23 |
1.0.24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31684 is a medium vulnerability (CVSS 4.3) in Broadcom Reactor Netty, published October 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in io.projectreactor.netty:reactor-netty-http 1.0.24.