Vulnerabilities > CVE-2023-34054 - Unspecified vulnerability in Pivotal Reactor Netty

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

pivotal

NVD

Published: 2023-11-28

Updated: 2023-12-04

Summary

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

Vulnerable Configurations

Part	Description	Count
Application	Pivotal Pivotal Reactor Netty * Pivotal Reactor Netty 0.5.1 Pivotal Reactor Netty 0.5.2 Pivotal Reactor Netty 0.6.0 Pivotal Reactor Netty 0.6.1 Pivotal Reactor Netty 0.6.2 Pivotal Reactor Netty 0.6.3 Pivotal Reactor Netty 0.6.4 Pivotal Reactor Netty 0.6.5 Pivotal Reactor Netty 0.6.6 Pivotal Reactor Netty 0.7.0 Pivotal Reactor Netty 0.7.1 Pivotal Reactor Netty 0.7.2 Pivotal Reactor Netty 0.7.3 Pivotal Reactor Netty 0.7.4 Pivotal Reactor Netty 0.7.5 Pivotal Reactor Netty 0.7.6 Pivotal Reactor Netty 0.7.7 Pivotal Reactor Netty 0.7.8 Pivotal Reactor Netty 0.7.9 Pivotal Reactor Netty 0.7.10 Pivotal Reactor Netty 0.7.11 Pivotal Reactor Netty 0.7.12 Pivotal Reactor Netty 0.7.13 Pivotal Reactor Netty 0.7.14 Pivotal Reactor Netty 0.7.15 Pivotal Reactor Netty 0.8.0 Pivotal Reactor Netty 0.8.1 Pivotal Reactor Netty 0.8.2 Pivotal Reactor Netty 0.8.3 Pivotal Reactor Netty 0.8.4 Pivotal Reactor Netty 0.8.5 Pivotal Reactor Netty 0.8.6 Pivotal Reactor Netty 0.8.7 Pivotal Reactor Netty 0.8.8 Pivotal Reactor Netty 0.8.9 Pivotal Reactor Netty 0.8.10 Pivotal Reactor Netty 0.8.11 Pivotal Reactor Netty 0.8.12 Pivotal Reactor Netty 0.8.13 Pivotal Reactor Netty 0.8.14 Pivotal Reactor Netty 0.8.15 Pivotal Reactor Netty 0.8.16 Pivotal Reactor Netty 0.9.0 Pivotal Reactor Netty 0.9.1 Pivotal Reactor Netty 0.9.2 Pivotal Reactor Netty 0.9.3 Pivotal Reactor Netty 0.9.4 Pivotal Reactor Netty 0.9.5 Pivotal Reactor Netty 1.0.11 Pivotal Reactor Netty 1.0.23	61

References

https://spring.io/security/cve-2023-34054