Reactor Netty
CVE-2023-34054
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1Blast Radius
ecosystem impact- 134 maven packages depend on io.projectreactor.netty:reactor-netty-core (9 direct, 125 indirect)
Ecosystem-wide dependent count for version 1.1.0.
DescriptionNVD
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.
AnalysisAI
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled. Affected products include: Pivotal Reactor Netty. Version information: prior to 1.1.13.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Reactor Netty
View allPivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. Rated h
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can se
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be
Credential leakage in the Reactor Netty WebSocket client exposes authentication data when a WebSocket handshake is redir
Credential leakage in the Reactor Netty HTTP client exposes authentication material when following redirects that cross
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorr
HTTP/1.1 request pipelining in Reactor Netty causes unbounded memory growth, exposing Spring WebFlux applications to ava
Reactor Netty HTTP Server incorrectly evaluates the remote client IP address in deployments where HAProxy PROXY Protocol
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests.
Exception detail leakage in Reactor Netty HTTP Server exposes internal error information across unrelated client request
DNS resolver isolation failure in Reactor Netty allows network-adjacent attackers to trigger incorrect DNS resolution by
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today