CVE-2026-47845 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses
Attackers can bypass IP-based security controls by spoofing remote addresses when HAProxy Protocol is enabled in Reactor Netty.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47845?
CVE-2026-47845 is a medium-severity vulnerability in Spring Reactor Netty, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
Weakness: CWE-290
Which versions are affected by CVE-2026-47845?
It affects 1 product.
Products include Broadcom Reactor Netty.
How do I fix CVE-2026-47845?
Upgrade to a fixed version.
Is CVE-2026-47845 being exploited?
There is no known exploitation of CVE-2026-47845 in the wild and no public exploit code.
Other vulnerabilities in Spring Reactor Netty
- CVE-2023-34062 In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack
- CVE-2019-11284 Reactor Netty authentication leak in redirects
- CVE-2020-5403 DoS Via Malformed URL with Reactor Netty HTTP Server
- CVE-2020-5404 Authentication Leak On Redirect With Reactor Netty HttpClient
- CVE-2026-47848 Reactor Netty WebSocket Client Leaks Credentials On Redirect
Sources
Also known as CLEANSTART-2026-ES91240, CLEANSTART-2026-GZ46020, CLEANSTART-2026-HS64071, CLEANSTART-2026-JY60048, CLEANSTART-2026-ZC51583, GHSA-c599-m66r-v62w.