Reactor Netty 1.1-1.3 HTTP/1.1 Pipelining Memory Exhaustion
CVE-2026-47874 Published on August 26, 2026
Reactor Netty HTTP Server Denial of Service With Pipelined Requests
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory.
Reactor Netty 1.3.0 - 1.3.6
Reactor Netty 1.1.0 - 1.2.18
Reactor Netty 1.0.52 and earlier
Vulnerability Analysis
CVE-2026-47874 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Products Associated with CVE-2026-47874
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Reactor Netty:- Version 1.3.0, <= 1.3.6 is affected.
- Version 1.1.0, <= 1.2.18 is affected.
- Before and including 1.0.52 is affected.