Junglewise Threat Intelligence

CVE-2026-47874: Reactor Netty HTTP server denial of service via pipelined requests

CVE-2026-47874 · Severity: medium · CVSS 5.3 · Published 2026-08-27

Technologies: Pivotal/Spring Reactor Netty.

Executive brief

Reactor Netty is a networking library used to build reactive HTTP servers. A vulnerability in how it handles HTTP/1.1 pipelined requests allows an attacker to send multiple requests over a single connection, causing the server to consume excessive memory and become unavailable to legitimate users, resulting in a denial of service.

Technical details

The vulnerability exists in Reactor Netty's HTTP/1.1 request handling when clients send pipelined requests (multiple requests sent in quick succession on a single persistent connection without waiting for responses). The vulnerable component fails to properly manage memory buffers, leading to unbounded memory accumulation. An attacker with network access can trigger this by sending a series of pipelined HTTP/1.1 requests, causing memory exhaustion and service unavailability. No authentication is required. Patches are available in versions 1.3.7+, 1.2.19+, and 1.0.53+.

Affected products

  • Pivotal/Spring Reactor Netty 1.3.0-1.3.6, 1.1.0-1.2.18, 1.0.52 and earlier

Timeline

  • 2026-08-27: disclosed

References