This vulnerability allows a client to send a succession of HTTP/1.1 pipelined requests over a single connection, which causes the Reactor Netty HTTP server to consume an unexpectedly large amount of memory. The result is a denial of service for the affected system, as the server can become unresponsive or crash when memory resources are exhausted. The weakness is a form of resource exhaustion flaw, affecting the integrity of service availability.

The flaw is present in Spring Reactor Netty version ranges 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and all releases 1.0.52 and earlier. Any application using these Reactor Netty components is potentially vulnerable if it accepts HTTP/1.1 pipelined requests.

The reported CVSS score is 5.3, indicating a moderate severity, and the EPSS score is 0.00238 (≈ 0.238 %), demonstrating a very low exploitation probability; the vulnerability is not listed in CISA’s KEV catalog. The attack vector is network‑based, as the exploit requires an external client to establish a TCP connection and issue pipelined HTTP/1.1 requests, and no special privileges or authentication are needed to trigger the flaw, making it broadly exploitable in environments where Reactor Netty is exposed to untrusted traffic.