CVE-2026-47874

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in Reactor Netty HTTP Server

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47874

EUVD

EUVD-2026-66831

Affected Vendors & Products

Vendor	Product	Version / Range
pivotal	reactor_netty	to 1.0.53 (exc)
pivotal	reactor_netty	From 1.1.0 (inc) to 1.2.19 (exc)
pivotal	reactor_netty	From 1.3.0 (inc) to 1.3.6.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection to the Reactor Netty HTTP server. This causes the server to consume an excessive amount of memory, potentially leading to a denial of service condition.

Detection Guidance

To detect this vulnerability, monitor for excessive memory consumption on systems running vulnerable Reactor Netty versions during HTTP/1.1 pipelined request activity. Check server logs for unusual patterns of pipelined requests. Use tools like netstat or ss to inspect active connections and request patterns. Ensure your Reactor Netty version is not in the vulnerable range (1.0.52 or earlier, 1.1.0-1.2.18, 1.3.0-1.3.6).

Impact Analysis

The vulnerability can cause the Reactor Netty HTTP server to run out of memory, leading to degraded performance or complete service disruption. This may result in downtime for applications relying on the server.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability primarily causes a denial of service through excessive memory consumption, which could indirectly affect availability requirements in these regulations.

Mitigation Strategies

Upgrade Reactor Netty to fixed versions: 1.3.7 (OSS), 1.3.6.1 (Enterprise), 1.2.19 (Enterprise), or 1.0.53 (Enterprise). No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-47874. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70