CVE-2026-47874: Reactor Netty HTTP/1.1 DOS Vulnerability

CVE-2026-47874 Overview

CVE-2026-47874 is a denial-of-service vulnerability in Reactor Netty's HTTP server. The flaw occurs when a client sends HTTP/1.1 pipelined requests over a single connection. The server consumes excessive memory while processing the pipelined stream, degrading availability for legitimate users.

Reactor Netty underpins Spring WebFlux and many reactive Java services, so the impact reaches a wide range of production HTTP endpoints. An unauthenticated remote attacker can trigger the condition over the network without user interaction.

Critical Impact
An unauthenticated attacker can exhaust server memory by pipelining HTTP/1.1 requests, causing degradation or denial of service on Reactor Netty HTTP servers.

Affected Products

Reactor Netty 1.3.0 through 1.3.6
Reactor Netty 1.1.0 through 1.2.18
Reactor Netty 1.0.52 and earlier

Discovery Timeline

2026-08-27 - CVE-2026-47874 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47874

Vulnerability Analysis

The vulnerability is a resource exhaustion issue in Reactor Netty's HTTP/1.1 request handling path. HTTP/1.1 pipelining permits a client to send multiple requests over a single TCP connection without waiting for prior responses. Reactor Netty buffers or queues these pipelined requests in a way that scales memory usage with the volume of inbound requests.

An attacker who sustains a stream of pipelined requests forces the server to allocate memory faster than it can drain the queue. The Java Virtual Machine (JVM) heap grows toward its configured maximum, garbage collection pressure rises, and request latency spikes. Sustained load can trigger OutOfMemoryError and process termination.

The defect requires no authentication and no user interaction. Any exposed HTTP endpoint served by a vulnerable Reactor Netty version is reachable. Spring WebFlux applications and other reactive services built on the affected releases inherit the exposure.

Root Cause

The root cause is unbounded resource consumption during pipelined HTTP/1.1 request processing. Reactor Netty does not enforce sufficient backpressure or queue limits on inbound pipelined requests. Memory growth is proportional to attacker-controlled input volume, matching the pattern described in [CWE-400: Uncontrolled Resource Consumption].

Attack Vector

The attack vector is a standard TCP connection to the HTTP listener. The attacker opens a keep-alive HTTP/1.1 session and writes many request lines and headers back-to-back without reading responses. See the Spring Security advisory for CVE-2026-47874 for the vendor description and version matrix.

Detection Methods for CVE-2026-47874

Indicators of Compromise

Sustained JVM heap growth on Reactor Netty processes without a corresponding increase in served responses.
Long-lived HTTP/1.1 connections from a single source with high inbound byte counts and near-zero outbound traffic.
Frequent full garbage collection cycles, followed by OutOfMemoryError entries in application logs.
Client IP addresses issuing large volumes of pipelined requests to reactive endpoints.

Detection Strategies

Monitor Reactor Netty and Netty channel metrics for queued inbound requests and pending write buffers on individual channels.
Correlate reverse proxy access logs for connections carrying an unusually high request-per-connection ratio.
Alert on JVM heap usage exceeding baseline thresholds on services running affected Reactor Netty versions.

Monitoring Recommendations

Export Micrometer and JVM metrics to a centralized observability stack and set thresholds on heap, GC pause time, and active connections.
Enable connection-level logging at the load balancer or ingress controller to identify pipelining behavior.
Ingest application and JVM telemetry into a centralized data lake to correlate memory pressure with request patterns across services.

How to Mitigate CVE-2026-47874

Immediate Actions Required

Inventory all applications and services that embed Reactor Netty, including Spring WebFlux workloads, and identify versions in scope.
Upgrade Reactor Netty to a fixed release above the affected ranges as documented in the Spring Security advisory.
Restart affected services after upgrade to ensure the patched classes are loaded.

Patch Information

VMware and the Reactor project have published fixes for the affected 1.0.x, 1.1.x/1.2.x, and 1.3.x branches. Refer to the Spring Security advisory for CVE-2026-47874 for the exact fixed versions and upgrade guidance. Rebuild and redeploy applications with the updated dependency to fully remediate.

Workarounds

Place a hardened reverse proxy in front of Reactor Netty services and disable or limit HTTP/1.1 pipelining at the proxy layer.
Enforce per-connection request rate limits and maximum in-flight request caps at the ingress controller or web application firewall.
Reduce Netty idle-timeout and maximum-request-header settings to close abusive connections quickly.
Restrict inbound access to trusted networks where feasible until patched builds are deployed.

bash

# Configuration example
# See the Spring Security advisory for the fixed version applicable to your branch:
# https://spring.io/security/cve-2026-47874

# Maven dependency upgrade (adjust version to the fixed release for your branch)
# <dependency>
#   <groupId>io.projectreactor.netty</groupId>
#   <artifactId>reactor-netty-http</artifactId>
#   <version>FIXED_VERSION</version>
# </dependency>

# Gradle dependency upgrade
# implementation 'io.projectreactor.netty:reactor-netty-http:FIXED_VERSION'