CVE-2026-47874
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Affects Reactor Netty 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.
Risk Assessment
An attacker can cause memory exhaustion on the server, potentially leading to denial of service (DoS) and unavailability of the application.
Recommendation
Update Reactor Netty to a patched version. If possible, restrict the ability to send pipelined HTTP/1.1 requests.
Other vulnerabilities in Reactor Netty
See all- CVE-2026-47845Medium
In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Affects Reactor Netty 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.
- CVE-2026-47848Medium
In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Affected versions: Reactor Netty 1.3.0 - 1.3.6, 1.1.0 - 1.2.18, and 1.0.52 and earlier.
- CVE-2026-47844Medium
In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. This requires Brave Tracing to be configured. Affected versions are 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.
- CVE-2026-47843Low
Reactor Netty in specific scenarios involving multiple clients with different DNS resolver configurations may incorrectly reuse a previously configured DNS resolver. Affects versions 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.
- CVE-2026-41715Medium
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. This requires the HTTP client to be explicitly configured to follow redirects. Affected versions: Reactor Netty 1.0.0-1.0.51, 1.1.0-1.1.35, 1.2.0-1.2.17, and 1.3.0-1.3.5.
Original NVD description (English source)
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier