CVE-2026-47845
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Affects Reactor Netty 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.
Risk Assessment
Incorrect IP address evaluation can lead to errors in logging, access control, or other security mechanisms based on IP address.
Recommendation
Update Reactor Netty to a patched version. If using HAProxy Protocol, ensure the configuration is correct.
Other vulnerabilities in Reactor Netty
See all- CVE-2026-47874Medium
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Affects Reactor Netty 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.
- CVE-2026-47848Medium
In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Affected versions: Reactor Netty 1.3.0 - 1.3.6, 1.1.0 - 1.2.18, and 1.0.52 and earlier.
- CVE-2026-47844Medium
In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. This requires Brave Tracing to be configured. Affected versions are 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.
- CVE-2026-47843Low
Reactor Netty in specific scenarios involving multiple clients with different DNS resolver configurations may incorrectly reuse a previously configured DNS resolver. Affects versions 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.
- CVE-2026-41715Medium
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. This requires the HTTP client to be explicitly configured to follow redirects. Affected versions: Reactor Netty 1.0.0-1.0.51, 1.1.0-1.1.35, 1.2.0-1.2.17, and 1.3.0-1.3.5.
Original NVD description (English source)
In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier