CVE-2026-47844 Reactor Netty HTTP Server Leaks Exception Details
Attackers can leak exception details across requests if Brave Tracing is enabled, exposing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47844?
CVE-2026-47844 is a medium-severity vulnerability in Spring Reactor Netty, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
Which versions are affected by CVE-2026-47844?
It affects 1 product.
Products include Broadcom Reactor Netty.
How do I fix CVE-2026-47844?
Upgrade to a fixed version.
Is CVE-2026-47844 being exploited?
There is no known exploitation of CVE-2026-47844 in the wild and no public exploit code.
Other vulnerabilities in Spring Reactor Netty
- CVE-2023-34062 In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack
- CVE-2019-11284 Reactor Netty authentication leak in redirects
- CVE-2020-5403 DoS Via Malformed URL with Reactor Netty HTTP Server
- CVE-2020-5404 Authentication Leak On Redirect With Reactor Netty HttpClient
- CVE-2026-47848 Reactor Netty WebSocket Client Leaks Credentials On Redirect
Sources
Also known as GHSA-xcw7-34p4-wrp4.