CVE-2023-34062
In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.
Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.
Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
- Record
CVE-2023-34062- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
EUVDEUVD-2023-3062
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.
Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
- Record
EUVD-2023-3062- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xjhv-p3fv-x24r
In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.
Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
- Record
GHSA-xjhv-p3fv-x24r- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.
Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
- Record
CVE-2023-34062- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.
Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
- Record
CVE-2023-34062- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-xjhv-p3fv-x24r
In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.
Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
- Record
GHSA-xjhv-p3fv-x24r- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Show 7 moreShow less
OSVROOT-APP-MAVEN-CVE-2023-34062
CVE-2023-34062 in io.root.io.projectreactor.netty:reactor-netty-http - Patched by Root
Root has patched CVE-2023-34062 in the io.root.io.projectreactor.netty:reactor-netty-http package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2023-34062- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1767744512 No score
TuxCare security update for io.projectreactor.netty (2 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 2 CVEs. Fixed in 1.0.32-tuxcare.1.
- Record
CLSA-2026-1767744512- Updated
- 2026-11-02
OSVCLSA-2026-1768435721 No score
TuxCare security update for io.projectreactor.netty (4 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 4 CVEs. Fixed in 1.0.23-tuxcare.1.
- Record
CLSA-2026-1768435721- Updated
- 2026-11-02
OSVCLSA-2026-1775003155 No score
TuxCare security update for io.projectreactor.netty:reactor-netty-http (2 CVEs)
TuxCare rebuilt io.projectreactor.netty:reactor-netty-http to address 2 CVEs. Fixed in 1.0.0-tuxcare.1.
- Record
CLSA-2026-1775003155- Updated
- 2026-11-02
OSVCLSA-2026-1776126825 No score
TuxCare security update for io.projectreactor.netty:reactor-netty-http (1 CVE)
TuxCare rebuilt io.projectreactor.netty:reactor-netty-http to address 1 CVE. Fixed in 1.0.7-tuxcare.1.
- Record
CLSA-2026-1776126825- Updated
- 2026-11-02
OSVCLSA-2026-1793345120 No score
TuxCare security update for io.projectreactor.netty (8 CVEs)
TuxCare rebuilt 4 io.projectreactor.netty packages to address 8 CVEs. Fixed in 1.0.34-tuxcare.1.
- Record
CLSA-2026-1793345120- Updated
- 2026-11-02
OSVCLSA-2026-1793619094 No score
TuxCare security update for io.projectreactor.netty (4 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 4 CVEs. Fixed in 1.0.18-tuxcare.1.
- Record
CLSA-2026-1793619094- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.projectreactor.netty:reactor-netty-httpMaven |
1.1.0 up to 1.1.13 | 1.1.13 |
io.projectreactor.netty:reactor-netty-httpMaven |
1.0.0 up to 1.0.39 | 1.0.39 |
io.projectreactor.netty:reactor-netty-coreTuxCare:Maven From an advisory covering 2 CVEs |
1.0.32 up to 1.0.32-tuxcare.1 | 1.0.32-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 2 CVEs |
1.0.32 up to 1.0.32-tuxcare.1 | 1.0.32-tuxcare.1 |
io.projectreactor.netty:reactor-netty-coreTuxCare:Maven From an advisory covering 4 CVEs |
1.0.23 up to 1.0.23-tuxcare.1 | 1.0.23-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 4 CVEs |
1.0.23 up to 1.0.23-tuxcare.1 | 1.0.23-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 2 CVEs |
1.0.0 up to 1.0.0-tuxcare.1 | 1.0.0-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven From an advisory covering 8 CVEs |
1.0.34 up to 1.0.34-tuxcare.1 | 1.0.34-tuxcare.1 |
io.projectreactor.netty:reactor-netty-coreTuxCare:Maven From an advisory covering 8 CVEs |
1.0.34 up to 1.0.34-tuxcare.1 | 1.0.34-tuxcare.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 8 CVEs |
1.0.34 up to 1.0.34-tuxcare.1 | 1.0.34-tuxcare.1 |
io.projectreactor.netty:reactor-netty-http-braveTuxCare:Maven From an advisory covering 8 CVEs |
1.0.34 up to 1.0.34-tuxcare.1 | 1.0.34-tuxcare.1 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven From an advisory covering 4 CVEs |
1.0.18 up to 1.0.18-tuxcare.1 | 1.0.18-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 4 CVEs |
1.0.18 up to 1.0.18-tuxcare.1 | 1.0.18-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpMaven |
1.1.0 up to 1.1.13, plus listed versions 1.1.11.1.101.1.111.1.121.1.2 Show 7 moreShow less1.1.31.1.41.1.51.1.61.1.71.1.81.1.9 |
1.1.13 |
io.projectreactor.netty:reactor-netty-httpMaven |
1.0.0 up to 1.0.39, plus listed versions 1.0.11.0.101.0.111.0.121.0.13 Show 33 moreShow less1.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.201.0.211.0.221.0.231.0.241.0.251.0.261.0.271.0.281.0.291.0.31.0.301.0.311.0.321.0.331.0.341.0.351.0.361.0.371.0.381.0.41.0.51.0.61.0.71.0.81.0.9 |
1.0.39 |
io.root.io.projectreactor.netty:reactor-netty-httpRoot:Maven |
before 1.1.10-root.io.1 | 1.1.10-root.io.11.1.10-root.io.41.1.10-root.io.51.1.13-root.io.11.1.13-root.io.21.1.13-root.io.3 |
io.projectreactor.netty:reactor-netty-httpRoot:Maven |
before 1.1.10-aikido.5 | 1.1.10-aikido.51.1.13-aikido.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-34062 is a high vulnerability (CVSS 7.5) in Broadcom Reactor Netty, published November 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. Fixed in io.projectreactor.netty:reactor-netty-http 1.1.13.
References
spring.io/security/cve-2023-34062
nvd.nist.gov/vuln/detail/CVE-2023-34062
github.com/reactor/reactor-netty/commit/b1dd46b9a424ca27f7f770be6561faa84d812e5b