CVE-2023-34062High· 7.5▾ TwilightIn Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an applicati…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.1%
1.1% → 1.1%
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.
Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
reactor_netty >= 1.0.0, < 1.0.39reactor_netty >= 1.1.0, < 1.1.13Upgrade past the affected range:
reactor_netty 1.1.13Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85487High· 8.8A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0
CVE-2026-85490High· 8.8When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction
CVE-2026-5049Medium· 5.7A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a
CVE-2026-94580Medium· 4.5An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1
CVE-2023-34054Medium· 5.3In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an …
CVE-2022-31684Medium· 4.3Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests