{"id":"CVE-2019-11284","aliases":["EUVD-2019-0705","GHSA-j52r-xc68-q8f4"],"status":"published","title":"Reactor Netty authentication leak in redirects","description":"Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.","severity":{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00902,"percentile":0.59953,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-522"],"published":"2019-10-17T17:40:12Z","modified":"2026-10-24T10:30:20Z","fixes":[{"ecosystem":"Maven","package":"io.projectreactor.netty:reactor-netty","fixed_in":["0.8.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.projectreactor.netty:reactor-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.11"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.projectreactor.netty:reactor-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.11"}]}],"versions":["0.8.0.RELEASE","0.8.1.RELEASE","0.8.10.RELEASE","0.8.2.RELEASE","0.8.3.RELEASE","0.8.4.RELEASE","0.8.5.RELEASE","0.8.6.RELEASE","0.8.7.RELEASE","0.8.8.RELEASE","0.8.9.RELEASE"]}],"products":[{"vendor":"broadcom","product":"reactor_netty"},{"vendor":"pivotal","product":"reactor netty"},{"vendor":"vmware","product":"reactor netty"}],"references":[{"url":"https://pivotal.io/security/cve-2019-11284","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11284","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j52r-xc68-q8f4"}],"sources":{"cve":[{"id":"CVE-2019-11284","title":"Reactor Netty authentication leak in redirects","description":"Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.","status":"published","published":"2019-10-17T17:40:12.123Z","modified":"2024-09-16T23:36:09.978Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:20:26.416173Z"}],"euvd":[{"id":"EUVD-2019-0705","description":"Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.","status":"published","published":"2019-10-17T17:40:12Z","modified":"2024-09-16T23:36:09Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:54:48.722382Z"}],"ghsa":[{"id":"GHSA-j52r-xc68-q8f4","title":"Insufficiently Protected Credentials in Pivotal Reactor Netty","description":"Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.","status":"published","published":"2019-10-23T14:14:32Z","modified":"2023-02-01T05:02:36Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:36:30.61364Z"}],"nvd":[{"id":"CVE-2019-11284","description":"Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.","status":"published","published":"2019-10-17T18:15:12.11Z","modified":"2026-09-04T18:59:12.37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:05:31.860711Z"}],"osv":[{"id":"CVE-2019-11284","description":"Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.","status":"published","published":"2019-10-17T18:15:12.11Z","modified":"2026-10-24T10:30:20.497237309Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-j52r-xc68-q8f4","title":"Insufficiently Protected Credentials in Pivotal Reactor Netty","description":"Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.","status":"published","published":"2019-10-23T14:14:32Z","modified":"2023-11-08T04:01:00.66051Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}