CVE-2026-47844: Reactor Netty Information Disclosure Flaw

CVE-2026-47844 Overview

CVE-2026-47844 affects the Reactor Netty HTTP Server when configured with Brave Tracing. Under specific conditions, the server can leak exception details from one request into the response context of an unrelated request. This cross-request information disclosure exposes internal error data to clients that should not receive it.

The vulnerability impacts multiple Reactor Netty release branches. It requires a Brave Tracing configuration to trigger and does not require authentication or user interaction to exploit over the network.

Critical Impact
Attackers can observe exception details from unrelated in-flight requests, potentially revealing internal application state, stack traces, or sensitive error context.

Affected Products

Reactor Netty 1.3.0 through 1.3.6
Reactor Netty 1.1.0 through 1.2.18
Reactor Netty 1.0.52 and earlier

Discovery Timeline

2026-08-26 - CVE-2026-47844 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-47844

Vulnerability Analysis

The defect is an information exposure issue in the Reactor Netty HTTP Server. When Brave Tracing is enabled, exception handling logic can associate error details with the wrong request context. A response returned to one client can then include exception information generated while processing a different, concurrent request.

The integrity impact is limited and confidentiality is not directly affected at the transport layer. However, leaked stack traces and exception messages can disclose internal implementation details, dependency versions, or partial data from other users' sessions. This class of flaw falls under Information Exposure and cross-request state contamination.

Exploitation does not require credentials. An unauthenticated remote attacker sending requests to a vulnerable server can observe leaked exception details in responses when other users trigger errors on the same server instance.

Root Cause

The root cause is improper isolation of exception state within the Brave Tracing integration path. Request-scoped error data is not correctly bound to the originating request context, allowing it to surface in unrelated response flows during concurrent processing.

Attack Vector

The attack vector is network-based against any Reactor Netty HTTP Server running an affected version with Brave Tracing configured. An attacker sends normal HTTP requests and monitors responses for exception content generated by other requests. Timing and volume of concurrent traffic influence the likelihood of observing leaked data.

No verified public exploit code is available. See the Spring Security Advisory CVE-2026-47844 for vendor technical details.

Detection Methods for CVE-2026-47844

Indicators of Compromise

Unexpected exception messages or stack traces appearing in HTTP responses that do not match the request path or parameters sent by the client.
Log entries showing exception context associated with request identifiers that differ from the originating trace ID.
Client-side reports of receiving error details referencing resources or user data they did not request.

Detection Strategies

Inventory all services using Reactor Netty and identify those configured with Brave Tracing. Match versions against the affected ranges listed in the Spring advisory.
Inspect application logs for correlation mismatches between request IDs, trace IDs, and exception stack traces emitted during concurrent load.
Run controlled load tests against non-production instances to observe whether error responses contain exception content unrelated to the triggering request.

Monitoring Recommendations

Alert on outbound HTTP responses containing stack trace patterns, package names, or exception class strings from server-side code.
Track error-response volume by endpoint and correlate spikes with tracing subsystem activity.
Ingest Reactor Netty and Brave Tracing logs into a centralized platform for cross-request correlation analysis.

How to Mitigate CVE-2026-47844

Immediate Actions Required

Upgrade Reactor Netty to a fixed release within the affected branch as specified in the Spring advisory.
Audit all applications embedding Reactor Netty, including Spring WebFlux and Spring Cloud Gateway deployments, for Brave Tracing configuration.
Disable verbose error responses that expose exception details to remote clients until the upgrade is complete.

Patch Information

Review the Spring Security Advisory CVE-2026-47844 for exact fixed version numbers and upgrade guidance for each affected branch (1.3.x, 1.2.x, and 1.0.x).

Workarounds

Remove or disable the Brave Tracing configuration on Reactor Netty HTTP Server instances that cannot be upgraded immediately.
Configure the HTTP server to return generic error responses that omit exception messages and stack traces.
Place an upstream reverse proxy or gateway that strips exception content from response bodies before delivery to clients.

bash

# Example: remove Brave Tracing dependency from a Maven build
mvn dependency:tree | grep brave
# Then exclude io.zipkin.brave:brave from the Reactor Netty consumer
# or set the HTTP server to skip tracing initialization until patched