Описание
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory.
Reactor Netty 1.3.0 - 1.3.6
Reactor Netty 1.1.0 - 1.2.18
Reactor Netty 1.0.52 and earlier
A flaw was found in the Reactor Netty HTTP server. A remote attacker can exploit this vulnerability by sending HTTP/1.1 pipelined requests over a single connection. This action causes the server to consume an excessive amount of memory, leading to a Denial of Service (DoS).
Отчет
An IMPORTANT severity denial-of-service flaw was found in the Reactor Netty HTTP server. A remote, unauthenticated attacker can send HTTP/1.1 pipelined requests over a single connection, causing the server to consume an excessive amount of memory, resulting in a denial of service. Upstream reports the affected versions as Reactor Netty 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier. The only Red Hat product record for this flaw is Red Hat JBoss Fuse (fuse-7-els-2 stream), which ships reactor-netty 0.9.25.RELEASE; the responsible engineering assessment determined that the vulnerable code is not present in that version, so Red Hat JBoss Fuse is not affected by this flaw and no Red Hat fix is required. Red Hat rates this flaw as IMPORTANT (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), which is higher than the upstream MEDIUM rating (5.3), because Red Hat assesses the availability impact as high rather than low.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | reactor-netty | Not affected |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
7.5 High
CVSS3