CVE-2026-47874

MediumCVSS 5.3/10Last modified Sep 2, 2026

Description

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Spring	Reactor Netty	>= 1.3.0, <= 1.3.6; >= 1.1.0, <= 1.2.18; <= 1.0.52

References

https://spring.io/security/cve-2026-47874Vendor Advisory

Timeline

Published: Aug 27, 2026
Last modified: Sep 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-478759.8Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if CVE-2026-478769.3VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative CVE-2026-478776.1Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1 CVE-2026-478787.3DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInpu CVE-2026-478798.7Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Clo CVE-2026-47885.5IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a local user.CVE-2026-478805.4A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named CVE-2026-478817.5Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that CVE-2026-478828.3When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Sp CVE-2026-478836.1UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter CVE-2026-478849.8Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view r CVE-2026-478857.5The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework