Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.projectreactor.netty:reactor-netty-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5MavenPublished

    Reactor Netty HTTP Server denial of service vulnerability

    CVE-2023-34054 · GHSA-q24v-hpg3-v3jp

    Affected
    • Maven io.projectreactor.netty:reactor-netty-core >= 1.1.0, < 1.1.13; >= 1.0.0, < 1.0.39
    Fixed in
    1.0.391.1.13· Vendor fix available
    Issue
    In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

    Recommended action: Upgrade to 1.1.13 or 1.0.39 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →