The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume… (CVE-2026-47874)

This vulnerability arises when a client sends multiple HTTP/1.1 pipelined requests on a single connection to the Reactor Netty HTTP server, leading to excessive memory consumption. Affected versions include Reactor Netty 1.0.52 and earlier, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6. The CVSS 3.1 score is 5.3, indicating a moderate impact primarily on availability. There is no indication of known exploits in the wild or impact on confidentiality or integrity.

The vulnerability can cause the Reactor Netty HTTP server to consume excessive memory, potentially leading to denial of service conditions. It does not affect data confidentiality or integrity but can degrade service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and consider limiting or disabling HTTP/1.1 pipelining if feasible as a temporary mitigation.