Executive brief
Reactor Netty is a networking library used to build reactive HTTP servers. A vulnerability in how it handles HTTP/1.1 pipelined requests allows an attacker to send multiple requests over a single connection, causing the server to consume excessive memory and become unavailable to legitimate users, resulting in a denial of service.
Technical details
The vulnerability exists in Reactor Netty's HTTP/1.1 request handling when clients send pipelined requests (multiple requests sent in quick succession on a single persistent connection without waiting for responses). The vulnerable component fails to properly manage memory buffers, leading to unbounded memory accumulation. An attacker with network access can trigger this by sending a series of pipelined HTTP/1.1 requests, causing memory exhaustion and service unavailability. No authentication is required. Patches are available in versions 1.3.7+, 1.2.19+, and 1.0.53+.
Affected products
- Pivotal/Spring Reactor Netty 1.3.0-1.3.6, 1.1.0-1.2.18, 1.0.52 and earlier
Timeline
- 2026-08-27: disclosed