CVE-2023-34054

MediumCVSS 5.3

Published: 28/11/2023(UTC)Updated: 04/09/2026(UTC)Translated: 05/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.91%

57th percentile - higher than 57% of all known CVEs

Summary

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

Risk Assessment

A DoS attack can make the HTTP server unavailable, potentially disrupting application functionality and business continuity.

Recommendation

Upgrade Reactor Netty to version 1.1.13 or later (for 1.1.x) and to 1.0.39 or later (for 1.0.x). If possible, consider disabling the Micrometer integration if not required.

Other vulnerabilities in Reactor Netty HTTP Server

CVE-2022-31684Medium
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS