CVE-2023-34054: Reactor Netty HTTP Server denial of service vulnerability

November 28, 2023

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

References

github.com/advisories/GHSA-q24v-hpg3-v3jp
github.com/reactor/reactor-netty/releases/tag/v1.0.39
github.com/reactor/reactor-netty/releases/tag/v1.1.13
nvd.nist.gov/vuln/detail/CVE-2023-34054
spring.io/security/cve-2023-34054

Detect and mitigate CVE-2023-34054 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →