CVE-2023-34054

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-34054
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-34054.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-34054
Aliases
Downstream
Related
Published
2023-11-28T08:16:14.361Z
Modified
2026-07-15T01:49:16.167605811Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Reactor Netty HTTP Server Metrics DoS Vulnerability
Details

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

Database specific 
{
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34054.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.1.0"
                },
                {
                    "fixed": "1.1.13"
                },
                {
                    "introduced": "1.0.0"
                },
                {
                    "fixed": "1.0.39"
                },
                {
                    "introduced": "older unsupported versions"
                },
                {
                    "last_affected": "older unsupported versions"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/reactor/reactor-netty

Affected ranges

Type
GIT
Repo
https://github.com/reactor/reactor-netty
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea31f0b8affd3db9d9bb66c979d157ac4a51e7b8
Introduced
476af8b7769680d8809709a94379c1a5a3df7120
Fixed
ee3c1ef697d1c96f6302503f181a093e8806f559
Database specific 
{
    "cpe": "cpe:2.3:a:pivotal:reactor_netty:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.39"
        },
        {
            "introduced": "1.1.0"
        },
        {
            "fixed": "1.1.13"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

0.*
0.8.0.M2
v0.*
v0.5.1.RELEASE
v0.5.2.RELEASE
v0.6.0.RELEASE
v0.6.1.RELEASE
v0.6.2.RELEASE
v0.6.3.RELEASE
v0.6.4.RELEASE
v0.7.0.M1
v0.7.0.M2
v0.7.0.RC1
v0.7.0.RELEASE
v0.7.1.RELEASE
v0.7.2.RELEASE
v0.7.3.RELEASE
v0.7.4.RELEASE
v0.7.5.RELEASE
v0.7.6.RELEASE
v0.7.7.RELEASE
v0.8.0.M1
v0.8.0.M3
v0.8.0.RELEASE
v0.8.1.RELEASE
v0.8.2.RELEASE
v0.8.3.RELEASE
v0.8.4.RELEASE
v0.8.5.RELEASE
v0.9.0.M1
v0.9.0.M2
v0.9.0.M3
v0.9.0.RC1
v0.9.0.RELEASE
v0.9.1.RELEASE
v0.9.2.RELEASE
v1.*
v1.0.0
v1.0.0-M1
v1.0.0-M2
v1.0.0-RC1
v1.0.0-RC2
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.0.2
v1.0.20
v1.0.21
v1.0.22
v1.0.23
v1.0.24
v1.0.25
v1.0.26
v1.0.27
v1.0.28
v1.0.29
v1.0.3
v1.0.30
v1.0.31
v1.0.32
v1.0.33
v1.0.34
v1.0.35
v1.0.36
v1.0.37
v1.0.38
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-34054.json"