Memory Exhaustion in Reactor Netty HTTP Server

Executive Summary

This vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection to the Reactor Netty HTTP server. This causes the server to consume an excessive amount of memory, potentially leading to a denial of service condition.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for excessive memory consumption on systems running vulnerable Reactor Netty versions during HTTP/1.1 pipelined request activity. Check server logs for unusual patterns of pipelined requests. Use tools like netstat or ss to inspect active connections and request patterns. Ensure your Reactor Netty version is not in the vulnerable range (1.0.52 or earlier, 1.1.0-1.2.18, 1.3.0-1.3.6).

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause the Reactor Netty HTTP server to run out of memory, leading to degraded performance or complete service disruption. This may result in downtime for applications relying on the server.

Useful 0 Not Useful 0

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability primarily causes a denial of service through excessive memory consumption, which could indirectly affect availability requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Reactor Netty to fixed versions: 1.3.7 (OSS), 1.3.6.1 (Enterprise), 1.2.19 (Enterprise), or 1.0.53 (Enterprise). No additional mitigation steps are required beyond upgrading.

Useful 0 Not Useful 0