Fluid Attacks Database

Description

Reactor Netty HTTP Server denial of service vulnerability In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	io.projectreactor.netty:reactor-netty-http	>=1.0.0 <1.0.39 \|\| >=1.1.0 <1.1.13	1.0.39, 1.1.13
maven	io.projectreactor.netty:reactor-netty	>=0 <1.0.39 \|\| >=1.1.0 <1.1.13	1.0.39, 1.1.13
maven	io.projectreactor.netty:reactor-netty-core	>=1.1.0 <1.1.13 \|\| >=1.0.0 <1.0.39	1.1.13, 1.0.39

Aliases

1. CVE-2023-340542. NVD-2023-340543. OSV-2023-340544. GHSA-q24v-hpg3-v3jp5. GCVE-2023-340546. SPRING-cve-2023-34054

References

1. https://github.com/reactor/reactor-netty/releases/tag/v1.0.392. https://github.com/reactor/reactor-netty/releases/tag/v1.1.133. https://github.com/reactor/reactor-netty/commit/37dc8a2ef6514cd7834e75e7f3faf0b9ea044c884. https://github.com/reactor/reactor-netty/commit/4ddbb1b9b985bb72290110ebae468a54e7f194205. https://github.com/reactor/reactor-netty/commit/ae82154e99e6f51f4816effd135f0c3a966d6ea36. https://spring.io/security/cve-2023-34054

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.