CVE-2020-5403: Improper Handling of Exceptional Conditions and Improper Input Validation in Reactor Netty
Summary
CVE-2020-5403: Improper Handling of Exceptional Conditions and Improper Input Validation in Reactor Netty. Affects io.projectreactor.netty:reactor-netty-http versions >= 0.9.3, < 0.9.5. Fixed in 0.9.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Reactor Netty HttpServer is a package in the Maven ecosystem that provides an HTTP server implementation based on the Reactor Netty library. It allows developers to build scalable and high-performance server applications. However, versions 0.9.3 and 0.9.4 of Reactor Netty HttpServer are affected by a vulnerability that can lead to premature closure of connections instead of producing a proper 400 response. This vulnerability is caused by an improper handling of exceptional conditions and improper input validation, specifically related to a URISyntaxException.
Vulnerability Detail
The vulnerability in Reactor Netty HttpServer allows an attacker to exploit a URISyntaxException, resulting in the premature closure of connections. This behavior deviates from the expected response of producing a 400 response. The impact of this vulnerability can be significant, as it can disrupt the normal flow of communication between clients and the server. This can potentially lead to denial of service (DoS) attacks or other security issues. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.4.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of Reactor Netty HttpServer.
Conclusion
The vulnerability in Reactor Netty HttpServer can have significant security implications, potentially leading to denial of service (DoS) attacks or other issues. It is crucial for developers to upgrade their dependency to the fixed version (0.9.5 or higher) to ensure proper handling of exceptional conditions and input validation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.projectreactor.netty:reactor-netty-http →
FAQ
Reactor Netty HttpServer is a package in the Maven ecosystem that provides an HTTP server implementation based on the Reactor Netty library. It allows developers to build scalable and high-performance server applications.
Versions 0.9.3 and 0.9.4 of Reactor Netty HttpServer are affected by this vulnerability.
The vulnerability can lead to premature closure of connections instead of producing a proper 400 response. This can disrupt the normal flow of communication between clients and the server, potentially leading to denial of service (DoS) attacks or other security issues.
To fix this vulnerability, you should upgrade your Reactor Netty HttpServer dependency to version 0.9.5 or higher.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of Reactor Netty HttpServer.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.projectreactor.netty:reactor-netty-http.
