Description
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Reactor Netty | 1.1.0 – < 1.1.13, 1.0.0 – < 1.0.39, older unsupported versions | 1.1.13 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.projectreactor.netty:reactor-netty-core | >= 1.1.0, < 1.1.13 | 1.1.13 | GHSA-q24v-hpg3-v3jp |
| Maven | io.projectreactor.netty:reactor-netty-core | >= 1.0.0, < 1.0.39 | 1.0.39 | GHSA-q24v-hpg3-v3jp |
Advisories 2
- WID-SEC-2024-1092 IBM Security Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 12, 2024
- WID-SEC-2024-0241 IBM Operational Decision Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 29, 2024