CVE-2026-47874: Reactor Netty HTTP Server Denial of Service With Pipelined Requests
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the Reactor Netty HTTP server are affected if they run versions 1.3.0 through 1.3.6, versions 1.1.0 through 1.2.18, or version 1.0.52 or earlier.
What does an attacker need to exploit this issue?
An attacker only needs network access to the HTTP server and can trigger the condition without authentication or user interaction by sending HTTP/1.1 pipelined requests over one connection.
What is the expected impact?
The server can consume excessive memory, resulting in a denial-of-service condition. The provided severity vector indicates no confidentiality or integrity impact.