CVE-2020-5403: DoS Via Malformed URL with Reactor Netty HTTP Server

Published Mar 3, 2020

Updated

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.

Affected Software

2 affected components

Pivotal Reactor Netty=0.9.3

Pivotal Reactor Netty=0.9.4

Event History

Mar 3, 2020

CVE Published

via MITRE·06:25 PM

Data Sourced

via MITRE·06:25 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-5403?

CVE-2020-5403 is a vulnerability in Reactor Netty HttpServer versions 0.9.3 and 0.9.4 that is exposed to a URISyntaxException, causing the connection to be closed prematurely instead of producing a 400 response.

What is the severity of CVE-2020-5403?

The severity of CVE-2020-5403 is high with a severity value of 7.5.

Which software versions are affected by CVE-2020-5403?

Reactor Netty HttpServer versions 0.9.3 and 0.9.4 are affected by CVE-2020-5403.

How can I fix CVE-2020-5403?

To fix CVE-2020-5403, it is recommended to upgrade to a version of Reactor Netty HttpServer that is not affected, such as version 0.9.5 or later.

Where can I find more information about CVE-2020-5403?

More information about CVE-2020-5403 can be found at the following link: https://pivotal.io/security/cve-2020-5403