How severe is CVE-2023-34054?

CVE-2023-34054 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2023-34054 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-34054?

CVE-2023-34054 affects Pivotal Reactor Netty. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-34054?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-34054 published?

CVE-2023-34054 was published on 2023-11-28 and last updated on 2026-06-17.

CVE-2023-34054

CVE-2023-34054 is a medium-severity vulnerability in Pivotal Reactor Netty with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 1% (56th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Pivotal Reactor Netty
Published: 2023-11-28
Last modified: 2026-06-17

Description

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

Frequently asked questions

What is CVE-2023-34054?: In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.
How severe is CVE-2023-34054?: CVE-2023-34054 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2023-34054 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-34054?: CVE-2023-34054 affects Pivotal Reactor Netty. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-34054?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-34054 published?: CVE-2023-34054 was published on 2023-11-28 and last updated on 2026-06-17.

References

https://spring.io/security/cve-2023-34054

Affected products (1)

cpe:2.3:a:pivotal:reactor_netty:*:*:*:*:*:*:*:*

More vulnerabilities in Pivotal Reactor Netty

CVE-2019-11284 — High (CVSS 8.6): Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A…
CVE-2023-34062 — High (CVSS 7.5): In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can…
CVE-2020-5403 — High (CVSS 7.5): Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be…
CVE-2020-5404 — Medium (CVSS 5.9): The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used…
CVE-2022-31684 — Medium (CVSS 4.3): Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests.…

All CVEs affecting Pivotal Reactor Netty →