{"id":"CVE-2026-47874","aliases":["CLSA-2026-1791529633","CLSA-2026-1791547948","CLSA-2026-1791989666","CLSA-2026-1792505040","CLSA-2026-1793116571","CLSA-2026-1793345120","EUVD-2026-66831","GHSA-fg4q-58fc-39w8"],"status":"published","title":"Reactor Netty HTTP Server Denial of Service With Pipelined Requests","description":"The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00402,"percentile":0.34745,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770"],"published":"2026-08-26T23:49:26Z","modified":"2026-11-02T19:46:31Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8}],"products":[{"vendor":"pivotal","product":"reactor_netty"},{"vendor":"spring","product":"reactor netty"},{"vendor":"vmware","product":"reactor netty"}],"references":[{"url":"https://spring.io/security/cve-2026-47874","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47874"},{"url":"https://github.com/advisories/GHSA-fg4q-58fc-39w8"}],"sources":{"cve":[{"id":"CVE-2026-47874","title":"Reactor Netty HTTP Server Denial of Service With Pipelined Requests","description":"The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T23:49:26.907Z","modified":"2026-08-27T13:12:29.108Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-66831","description":"The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T23:49:26Z","modified":"2026-08-27T13:12:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:28.581047Z"}],"ghsa":[{"id":"GHSA-fg4q-58fc-39w8","title":"The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection...","description":"The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-27T03:32:58Z","modified":"2026-08-27T18:32:08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:11:03.315113Z"}],"nvd":[{"id":"CVE-2026-47874","description":"The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-27T01:17:33.62Z","modified":"2026-09-02T15:50:42.727Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CLSA-2026-1791529633","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.1.31-tuxcare.4.","status":"published","published":"2026-10-09T07:07:13Z","modified":"2026-11-02T19:46:27.100145141Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791547948","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.48-tuxcare.5.","status":"published","published":"2026-10-09T12:12:28Z","modified":"2026-11-02T19:46:26.379358987Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791989666","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.2.18-tuxcare.2.","status":"published","published":"2026-10-14T14:54:26Z","modified":"2026-11-02T19:46:27.828680262Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792505040","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.32-tuxcare.6.","status":"published","published":"2026-10-20T14:04:00Z","modified":"2026-11-02T19:46:29.903938891Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793116571","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.1.15-tuxcare.3.","status":"published","published":"2026-10-27T15:56:11Z","modified":"2026-11-02T19:46:31.80652923Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793345120","title":"TuxCare security update for io.projectreactor.netty (8 CVEs)","description":"TuxCare rebuilt 4 io.projectreactor.netty packages to address 8 CVEs. Fixed in 1.0.34-tuxcare.1.","status":"published","published":"2026-10-30T08:25:21Z","modified":"2026-10-30T13:30:08.72554284Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}