7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-34054

CVE-2023-34054: Reactor Netty HTTP Server denial of service vulnerability

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-34054

CVE-2023-34054:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.projectreactor.netty:reactor-netty-core	maven	>= 1.1.0, < 1.1.13	1.1.13
io.projectreactor.netty:reactor-netty-core	maven	>= 1.0.0, < 1.0.39	1.0.39

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description states that a DoS condition can occur if Reactor Netty HTTP Server's built-in integration with Micrometer is enabled. The provided patches (specifically 37dc8a2ef6514cd7834e75e7f3faf0b9ea044c88, ae82154e99e6f51f4816effd135f0c3a966d6ea3, and refined by 4ddbb1b9b985bb72290110ebae468a54e7f19420) modify the disposeInactivePoolsInBackground method in PooledConnectionProvider.java. The core change involves adding explicit logic to deregister metrics when an inactive connection pool is disposed. Before this change, the simple disposal of the pool (e.getValue().dispose();) did not handle the deregistration of associated Micrometer metrics. This omission would lead to an accumulation of metric-related resources, eventually causing a DoS. Therefore, the disposeInactivePoolsInBackground function, in its state before the patch, is identified as the vulnerable function because it failed to properly manage resources related to Micrometer metrics during pool disposal.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.