CVE-2023-34054 Reactor Netty HTTP Server Metrics DoS Vulnerability

What is CVE-2023-34054?

CVE-2023-34054 is a medium-severity denial of service vulnerability in Spring Reactor Netty, published on 28 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

Which versions are affected by CVE-2023-34054?

4 open source packages ship an affected version, including io.projectreactor.netty:reactor-netty-core. It affects 1 product.

Products include Broadcom Reactor Netty.

How do I fix CVE-2023-34054?

Upgrade io.projectreactor.netty:reactor-netty-core to a fixed version for your release line: 1.0.39 or 1.1.13.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-34054 being exploited?

There is no known exploitation of CVE-2023-34054 in the wild and no public exploit code.

Other vulnerabilities in Spring Reactor Netty

• CVE-2023-34062 In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack High 7.5
• CVE-2019-11284 Reactor Netty authentication leak in redirects Medium 6.8
• CVE-2020-5403 DoS Via Malformed URL with Reactor Netty HTTP Server Medium 6.5
• CVE-2020-5404 Authentication Leak On Redirect With Reactor Netty HttpClient Medium 6.5
• CVE-2026-47848 Reactor Netty WebSocket Client Leaks Credentials On Redirect Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q24v-hpg3-v3jp, ROOT-APP-MAVEN-CVE-2023-34054.