Spring Boot 2.7.14下替代Netty/Jetty降低漏洞风险方案咨询

我使用Spring Boot 2.7.14且无法升级至新版本，当前依赖的reactor-netty-core 1.1.9存在多个严重、高危及中等CVE漏洞；尝试替换为最新版Netty或Jetty后，仍检测到包括严重级在内的漏洞。需要一种ClientHttpConnector实现，寻求降低漏洞风险的方案或替代库建议。

漏洞列表 #

1. 升级Reactor Netty至Spring Boot 2.7.x兼容的最高版本 #

Spring Boot 2.7.x系列兼容Reactor Netty 1.1.x分支的所有版本，无需升级Spring Boot主版本，可通过依赖管理强制升级Reactor Netty以修复已知CVE漏洞。

Maven配置 #

在pom.xml的dependencyManagement中添加：

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>io.projectreactor.netty</groupId>
            <artifactId>reactor-netty-core</artifactId>
            <version>1.1.18</version>
        </dependency>
        <dependency>
            <groupId>io.projectreactor.netty</groupId>
            <artifactId>reactor-netty-http</artifactId>
            <version>1.1.18</version>
        </dependency>
    </dependencies>
</dependencyManagement>

Gradle配置 #

在build.gradle中添加：

dependencyManagement {
    imports {
        mavenBom 'io.projectreactor:reactor-bom:2020.0.34'
    }
}

注：2020.0.34 Bom对应Reactor Netty 1.1.18，是1.1.x分支的最新稳定版，已修复上述绝大多数CVE。

2. 替换为Apache HttpClient作为ClientHttpConnector #

如果升级Reactor Netty仍无法解决漏洞问题，可以切换到Apache HttpClient实现ClientHttpConnector，完全替换Reactor Netty的客户端功能。

步骤1：排除Reactor Netty依赖 #

Maven：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-webflux</artifactId>
    <exclusions>
        <exclusion>
            <groupId>io.projectreactor.netty</groupId>
            <artifactId>reactor-netty-http</artifactId>
        </exclusion>
    </exclusions>
</dependency>

Gradle：

implementation('org.springframework.boot:spring-boot-starter-webflux') {
    exclude group: 'io.projectreactor.netty', module: 'reactor-netty-http'
}

步骤2：引入Apache HttpClient依赖 #

Maven：

<dependency>
    <groupId>org.apache.httpcomponents.client5</groupId>
    <artifactId>httpclient5</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-httpclient</artifactId>
</dependency>

Gradle：

implementation 'org.apache.httpcomponents.client5:httpclient5'
implementation 'org.springframework.boot:spring-boot-starter-httpclient'

步骤3：配置HttpClient的ClientHttpConnector #

创建配置类，替换默认的Reactor Netty连接器：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.client.HttpComponentsClientHttpConnector;
import org.springframework.web.reactive.function.client.WebClient;

@Configuration
public class WebClientConfig {

    @Bean
    public WebClient webClient() {
        return WebClient.builder()
                .clientConnector(new HttpComponentsClientHttpConnector())
                .build();
    }
}

3. 临时漏洞规避措施（应急方案） #

如果上述方案暂时无法落地，可以针对特定CVE配置Reactor Netty参数缓解风险：

• CVE-2022-41881（HTTP请求走私）：启用严格的HTTP解析模式

import reactor.netty.http.client.HttpClient;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.client.reactive.ReactorClientHttpConnector;
import org.springframework.web.reactive.function.client.WebClient;

@Configuration
public class ReactorNettyConfig {

    @Bean
    public WebClient webClient() {
        HttpClient httpClient = HttpClient.create()
                .httpResponseDecoder(spec -> spec.maxInitialLineLength(4096)
                        .maxHeaderSize(8192)
                        .strict(true)); // 启用严格解析
        return WebClient.builder()
                .clientConnector(new ReactorClientHttpConnector(httpClient))
                .build();
    }
}

• 内存泄漏相关CVE：配置连接池超时和最大连接数，避免资源耗尽

HttpClient httpClient = HttpClient.create()
        .poolResources(pool -> pool.maxConnections(100)
                .pendingAcquireTimeout(Duration.ofSeconds(10)));

内容的提问来源于stack exchange，提问作者babicsp