{"id":"CVE-2023-34062","title":"In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.\n\nSpecifically, an applicati…","summary":"In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.\n\nSpecifically, an applicati…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-22"],"vendor":"broadcom","product":"reactor_netty","affected":["reactor_netty >= 1.0.0, < 1.0.39","reactor_netty >= 1.1.0, < 1.1.13"],"patched":["reactor_netty 1.1.13"],"published":"2023-11-15","updated":"2026-09-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-34062","references":[{"url":"https://spring.io/security/cve-2023-34062","label":"security@vmware.com"},{"url":"https://spring.io/security/cve-2023-34062","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.01115,"epssPercentile":0.64635,"ingestedAt":"2026-09-04T19:26:35.385Z","slug":"CVE-2023-34062","body":"## Overview\n\nIn Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.\n\nSpecifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.\n\n\n\n\n## Affected\n\n- `reactor_netty >= 1.0.0, < 1.0.39`\n- `reactor_netty >= 1.1.0, < 1.1.13`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `reactor_netty 1.1.13`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}