EUVD-2026-66831
GHSA-fg4q-58fc-39w8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Unauthenticated network clients trigger memory exhaustion via pipelining; impact is limited to low availability with no confidentiality or integrity consequence.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
1DescriptionCVE.org
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
AnalysisAI
HTTP/1.1 request pipelining in Reactor Netty causes unbounded memory growth, exposing Spring WebFlux applications to availability degradation or denial of service from unauthenticated remote clients. Three release trains are affected - 1.0.x through 1.0.52, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6 - giving this issue broad coverage across current and legacy Spring reactive deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application runs Reactor Netty within an affected version range (1.0.52 or earlier, 1.1.0-1.2.18, or 1.3.0-1.3.6) and is reachable over the network by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately reflects the real-world risk ceiling: the vulnerability is network-reachable by unauthenticated clients with low attack complexity, but produces only a low availability impact - progressive memory pressure rather than immediate crash in most JVM configurations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the VMware/Spring vendor advisory at https://spring.io/security/cve-2026-47874 for patched versions across the affected 1.0.x, 1.1.x/1.2.x, and 1.3.x release trains and upgrade to the latest patched release within the applicable branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. Rated critical severi
Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user dat
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing u
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant
SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through t
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated at
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Sprin
Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJso
Spring Security Aspects may not correctly locate method security annotations on private methods. Rated critical severity
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input esca
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today