Advisoriesby IbisVMwareCVE-2026-47874
VMware Reactor Netty: resource exhaustion
No fix yet
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory.
Reactor Netty 1.3.0 - 1.3.6
Reactor Netty 1.1.0 - 1.2.18
Reactor Netty 1.0.52 and earlier
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Reactor Netty Product | >= 1.3.0, <= 1.3.6 | No fix yet |
| >= 1.1.0, <= 1.2.18 | No fix yet | |
| <= 1.0.52 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-770