{"action":"Upgrade io.projectreactor.netty:reactor-netty-http to 1.0.24 or later.","affected":[{"fixed":"1.0.24","introduced":"1.0.11"}],"component":"io.projectreactor.netty:reactor-netty-http","cve_ids":["CVE-2022-31684"],"ecosystem":"Maven","epss":0.00759,"exploited":false,"fixed_versions":["1.0.24"],"ghsa_id":"GHSA-7w4x-4h67-pgmv","id":"tcs_01M5N8KAF49NHKEWJ7GA8125VF","modified_at":"2025-05-09T17:28:31.255944Z","published_at":"2022-10-20T12:00:17Z","references":["https://osv.dev/vulnerability/GHSA-7w4x-4h67-pgmv","https://nvd.nist.gov/vuln/detail/CVE-2022-31684","https://search.maven.org/artifact/io.projectreactor.netty/reactor-netty-http","https://tanzu.vmware.com/security/cve-2022-31684"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-7w4x-4h67-pgmv","url":"https://osv.dev/vulnerability/GHSA-7w4x-4h67-pgmv"}],"summary":"Invalid HTTP requests in Reactor Netty HTTP Server may reveal access tokens"}