Reactor Netty HTTP Server Metrics DoS Vulnerability
CVE-2023-34054

7.5HIGH

Key Information:

Vendor

Spring

Status
Reactor Netty
Vendor
CVE Published:
28 November 2023

What is CVE-2023-34054?

A vulnerability exists in Reactor Netty HTTP Server where specially crafted HTTP requests can lead to a denial-of-service condition. This affects applications utilizing the server's built-in integration with Micrometer. Versions prior to 1.1.13 in the 1.1.x series and versions prior to 1.0.39 in the 1.0.x series are impacted, posing a risk to systems relying on these versions for their HTTP server functionalities.

Affected Version(s)

Reactor Netty Windows 1.1.0 < 1.1.13

Reactor Netty Windows 1.0.0 < 1.0.39

Reactor Netty Windows older unsupported versions

References

https://spring.io/security/cve-2023-34054

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-34054 : Reactor Netty HTTP Server Metrics DoS Vulnerability