Reactor Netty CVE-2026-47874

Exploitation requires that the target application runs Reactor Netty within an affected version range (1.0.52 or earlier, 1.1.0-1.2.18, or 1.3.0-1.3.6) and is reachable over the network by the attacker. The attacker must use HTTP/1.1 pipelining - supported natively by standard HTTP/1.1 clients and requiring no special attacker capability. No authentication is required per CVSS PR:N. Exploitation is limited or negated in environments where a reverse proxy, API gateway, or TLS terminator sits in front of Reactor Netty and normalizes or drops pipelined connections before they reach the application layer; such infrastructure is common in production microservice deployments.

The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately reflects the real-world risk ceiling: the vulnerability is network-reachable by unauthenticated clients with low attack complexity, but produces only a low availability impact - progressive memory pressure rather than immediate crash in most JVM configurations. EPSS data was not supplied in the available intelligence, and the CVE is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. No public exploit code was identified. Practical exposure is meaningfully reduced in environments where a reverse proxy or API gateway sits upstream and normalizes or terminates HTTP/1.1 pipelining before traffic reaches Reactor Netty; organizations exposing the library directly to untrusted networks face a higher realistic risk. The 'Information Disclosure' tag conflicts with the DoS framing in the description - this data-quality discrepancy should be resolved against the vendor advisory before finalizing risk triage.

An unauthenticated attacker sends a sustained stream of HTTP/1.1 pipelined requests over one or more TCP connections to a publicly reachable Reactor Netty service. The server accumulates buffered request data without adequate bounds, causing JVM heap exhaustion that degrades or denies service to legitimate clients. No special tooling or exploit code is required - standard HTTP/1.1 clients or widely available load-testing tools can generate pipelined requests.