CVE-2026-47874

Overview

Reactor Netty is the reactive networking layer of Project Reactor: it wraps Netty in a Reactive Streams API and supplies the non-blocking HTTP client and server that Spring WebFlux runs on. The reactor-netty-http module carries the Reactor Netty HTTP client and server.

A denial of service vulnerability (CVE-2026-47874) has been identified in the Reactor Netty HTTP server, which allows attackers to make the server consume an excessive amount of memory by sending HTTP/1.1 pipelined requests over a single connection.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects multiple versions of Reactor Netty.

Details

Module Info

• Product: Reactor Netty
• Affected packages: io.projectreactor.netty:reactor-netty-http
• Affected versions: <=1.0.52, >=1.1.0 <=1.2.18, >=1.3.0 <=1.3.6
• GitHub repository: https://github.com/reactor/reactor-netty
• Published packages: https://central.sonatype.com/artifact/io.projectreactor.netty/reactor-netty-http
• Package manager: Maven
• Fixed in:
  • OSS Reactor Netty 1.3.7
  • NES for Reactor Netty v1.0.51

Vulnerability Info

This Medium-severity vulnerability is found in the io.projectreactor.netty:reactor-netty-http package in multiple versions of Reactor Netty. HTTP/1.1 pipelining lets a client send several requests on one connection without waiting for each response. The server's HttpTrafficHandler answers them in order, so while a response is still pending, channelRead() hands every further request, and every content chunk that follows it, to doPipeline() to be held until earlier responses complete:

void doPipeline(ChannelHandlerContext ctx, Object msg) {
	if (pipelined == null) {
		pipelined = Queues.unbounded()
		                  .get();
	}
	if (!pipelined.offer(msg)) {
		ctx.fireExceptionCaught(Exceptions.failWithOverflow());
	}
}

The queue is unbounded, so offer() never fails and the overflow branch is never reached. Nothing in the handler applies back-pressure either: it keeps reading from the socket while messages pile up in the queue. A client that writes a long stream of pipelined requests while earlier responses are still pending makes the server buffer all of them in memory for that one connection. A single connection, or a few of them, can exhaust the server's memory and degrade service for other clients.

Mitigation

Only recent versions of Reactor Netty are community-supported. Older release lines are End-of-Life and will not receive community updates addressing this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade Reactor Netty to a currently supported release containing the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Yu Bao from PayPal Cyber Security Team (finder)
• Qifeng Fang (finder)