{"id":"CVE-2019-11284","aliases":["GHSA-j52r-xc68-q8f4"],"url":"https://o3.security/vulnerability/CVE-2019-11284","summary":"Insufficiently Protected Credentials in Pivotal Reactor Netty","details":"Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.","published":"2019-10-17T18:15:12.110Z","modified":"2026-07-08T16:27:49.769849Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},"epss":{"score":0.00894,"percentile":0.56356,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.projectreactor.netty:reactor-netty","fixedVersion":"0.8.11"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://pivotal.io/security/cve-2019-11284"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T16:27:49.769849Z"}}