Vulnerability found in v26.6.1.24 of cloud proxy software.

Products

• DX SaaS

Issue/Introduction

Detection info: End-of-Life Version of Technology - The technology Reactor Netty version 1.2.16 associated with the path /apps/<path>libs/reactor-netty-http-1.2.16.jar has been End-of-Life since 2026-06-30. End-of-Life versions of technologies have no further official support by the vendor and thus no security patches. Furthermore, newly discovered vulnerabilities are not reported. Thus, such technologies pose a threat that is both unknown and will not be fixed.

Resolution

Vmware is supporting reactor jetty until 2032. 

Otherwise, there will be a BootSpring upgrade which is several months away. 

*** More details ***

The reference for reactor-netty-core:jar:1.2.x is coming from datastore.common.client. In a short term, DataStore plans major Spring Boot/Spring Framework upgrades starting this product increment. You can track this feature in Rally: F168449: DataStore Spring Boot 4.x Upgrade

Anyway, we still have the commercial support for Spring Boot/Spring Framework through VMware Tanzu / Broadcom. This commercial support extends full security patching, critical bug fixes, and operational assistance for Reactor Netty 1.2.x through June 30, 2032.