Lucene search

Veracode Vulnerability DatabaseVERACODE:44472

HistoryNov 29, 2023 - 9:58 a.m.

Denial Of Service

2023-11-2909:58:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

reactor netty

http server

denial of service

vulnerability

improper validation

micrometer integration

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

11.8%

JSON

Reactor Netty HTTP Server is vulnerable to Denial Of Service (DOS). The vulnerability is due to the improper validation of HTTP requests while if the micrometer integration is enabled, which can result in Denial Of Service.

CPENameOperatorVersion
http functionality for the reactor netty libraryle1.0.38
http functionality for the reactor netty libraryle1.1.12
http functionality for the reactor netty libraryle1.0.38
http functionality for the reactor netty libraryle1.1.12

Name	Operator	Version
http functionality for the reactor netty library	le	1.0.38
http functionality for the reactor netty library	le	1.1.12
http functionality for the reactor netty library	le	1.0.38
http functionality for the reactor netty library	le	1.1.12

References

github.com/advisories/GHSA-q24v-hpg3-v3jp

github.com/reactor/reactor-netty/commit/37dc8a2ef6514cd7834e75e7f3faf0b9ea044c88

spring.io/security/cve-2023-34054

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

11.8%

JSON

Related for VERACODE:44472