CVE-2023-34054 - Vulnerability Details - OpenCVE

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00914.

Key SSVC decision points have not yet been added.

Vendors	Products
Broadcom	Reactor Netty

Configuration 1 [-]

OR	cpe:2.3:a:broadcom:reactor_netty::::::::
	cpe:2.3:a:broadcom:reactor_netty::::::::

No data.

No data.

References

Link	Providers
https://spring.io/security/cve-2023-34054

History

Fri, 04 Sep 2026 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Broadcom Broadcom reactor Netty
CPEs	cpe:2.3:a:pivotal:reactor_netty::::::::	cpe:2.3:a:broadcom:reactor_netty::::::::
Vendors & Products	Pivotal Pivotal reactor Netty	Broadcom Broadcom reactor Netty

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2023-11-28T08:16:14.361Z

Updated: 2024-08-02T16:01:52.415Z

Reserved: 2023-05-25T17:21:56.203Z

Link: CVE-2023-34054

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-11-28T09:15:07.147

Modified: 2026-09-04T18:59:12.370

Link: CVE-2023-34054

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-34054", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2023-05-25T17:21:56.203Z", "datePublished": "2023-11-28T08:16:14.361Z", "dateUpdated": "2024-08-02T16:01:52.415Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "MacOS", "Linux", "iOS", "Android", "x86", "ARM", "64 bit", "32 bit"], "product": "Reactor Netty", "vendor": "Spring", "versions": [{"lessThan": "1.1.13", "status": "affected", "version": "1.1.0", "versionType": "1.1.13"}, {"lessThan": "1.0.39", "status": "affected", "version": "1.0.0", "versionType": "1.0.39"}, {"status": "affected", "version": "older unsupported versions"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p>In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.</p><p>Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.</p><p></p><br>"}], "value": "\nIn Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.\n\n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2023-11-28T08:16:57.848Z"}, "references": [{"url": "https://spring.io/security/cve-2023-34054"}], "source": {"discovery": "UNKNOWN"}, "title": "Reactor Netty HTTP Server Metrics DoS Vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:01:52.415Z"}, "title": "CVE Program Container", "references": [{"url": "https://spring.io/security/cve-2023-34054", "tags": ["x_transferred"]}]}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows", "MacOS", "Linux", "iOS", "Android", "x86", "ARM", "64 bit", "32 bit"], "product": "Reactor Netty", "vendor": "Spring", "versions": [{"lessThan": "1.1.13", "status": "affected", "version": "1.1.0", "versionType": "1.1.13"}, {"lessThan": "1.0.39", "status": "affected", "version": "1.0.0", "versionType": "1.0.39"}, {"status": "affected", "version": "older unsupported versions"}]}], "source": "[email protected]"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:reactor_netty:*:*:*:*:*:*:*:*", "matchCriteriaId": "4B0BC515-4BA7-4434-963C-7CFA52A710CD", "versionEndExcluding": "1.0.39", "vulnerable": true}, {"criteria": "cpe:2.3:a:broadcom:reactor_netty:*:*:*:*:*:*:*:*", "matchCriteriaId": "82F648AD-33BC-435E-94E9-A701C2DF0931", "versionEndExcluding": "1.1.13", "versionStartIncluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "\nIn Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.\n\n\n\n\n"}, {"lang": "es", "value": "En Reactor Netty HTTP Server, versiones 1.1.x anteriores a 1.1.13 y versiones 1.0.x anteriores a 1.0.39, es posible que un usuario proporcione solicitudes HTTP especialmente manipuladas que pueden causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS). Espec\u00edficamente, una aplicaci\u00f3n es vulnerable si la integraci\u00f3n integrada del servidor HTTP Reactor Netty con Micrometer est\u00e1 habilitada."}], "id": "CVE-2023-34054", "lastModified": "2026-09-04T18:59:12.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-11-28T09:15:07.147", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2023-34054"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2023-34054"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "[email protected]", "type": "Primary"}]}