In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Spring | Reactor Netty | unaffected |
|
Configuration 1 [-]
|
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-3013 | In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled. |
 Github GHSA |
GHSA-q24v-hpg3-v3jp | Reactor Netty HTTP Server denial of service vulnerability |
| Link | Providers |
|---|---|
| https://spring.io/security/cve-2023-34054 |
|
No history.
MITRE
Status: PUBLISHED
Assigner: vmware
Published:
Updated: 2024-08-02T16:01:52.415Z
Reserved: 2023-05-25T17:21:56.203Z
Link: CVE-2023-34054
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-11-28T09:15:07.147
Modified: 2024-11-21T08:06:29.087
Link: CVE-2023-34054
Redhat
No data.
OpenCVE Enrichment
No data.