CVE-2023-34054 Reactor Netty HTTP Server Metrics DoS Vulnerability

🗓️ 28 Nov 2023 08:16:14Reported by vmwareType

Reactor Netty HTTP Server DoS Vulnerability in versions 1.1.x and 1.0.x

Reporter	Title	Published	Views	Family All 26
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.5 fixes multiple security vulnerabilities	26 Mar 202503:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	26 Mar 202504:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Cloud Gateway Server, Bouncy Castle, Reactor Netty HTTP Server, NPM and Apache Commons might affect IBM Storage Defender Copy Data Management	30 Sep 202521:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for January 2024 - Multiple CVEs addressed	15 Apr 202502:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Disconnected Log Collector includes components with known vulnerabilities	11 Apr 202421:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana is affected by Multiple Security Vulnerabilities	16 Feb 202408:48	–	ibm
BDU FSTEC	The vulnerability of the Reactor Netty HTTP server, related to uncontrolled resource consumption, allows attackers to cause service failures.	11 Jan 202400:00	–	bdu_fstec
Chainguard	CVE-2023-34054 vulnerabilities	28 Nov 202309:15	–	cgr
Circl	CVE-2023-34054	17 Dec 202317:12	–	circl
CNNVD	Reactor Netty Security Vulnerability	28 Nov 202300:00	–	cnnvd

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "MacOS",
      "Linux",
      "iOS",
      "Android",
      "x86",
      "ARM",
      "64 bit",
      "32 bit"
    ],
    "product": "Reactor Netty",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "1.1.13",
        "status": "affected",
        "version": "1.1.0",
        "versionType": "1.1.13"
      },
      {
        "lessThan": "1.0.39",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "1.0.39"
      },
      {
        "status": "affected",
        "version": "older unsupported versions"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2023-34054

28 Nov 2023 08:16Current

7.6High risk

Vulners AI Score7.6

CVSS 3.15.3

EPSS0.00906