CVE-2026-47845: Reactor Netty IP Disclosure Vulnerability

CVE-2026-47845 Overview

CVE-2026-47845 is a medium severity vulnerability in Reactor Netty HTTP Server. The flaw causes incorrect evaluation of the remote client IP address when HAProxy Protocol is enabled. Applications that rely on the reported client IP for logging, rate limiting, or access control decisions may receive inaccurate values in specific scenarios.

The issue affects Reactor Netty versions 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 and earlier. Only deployments that explicitly enable HAProxy Protocol support are exposed.

Critical Impact
Applications enforcing IP-based security controls may trust spoofed or incorrect remote addresses, undermining allow lists, audit trails, and abuse mitigation.

Affected Products

Reactor Netty 1.3.0 - 1.3.6
Reactor Netty 1.1.0 - 1.2.18
Reactor Netty 1.0.52 and earlier

Discovery Timeline

2026-08-27 - CVE CVE-2026-47845 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47845

Vulnerability Analysis

Reactor Netty is a reactive, non-blocking HTTP client and server library built on Netty and widely used by Spring WebFlux applications. The HTTP server supports the HAProxy Protocol, which prepends a header to TCP connections so upstream load balancers can forward the original client IP address to the backend.

In specific scenarios, the HTTP server does not correctly evaluate this remote address. As a result, the value exposed to application code through the connection metadata may not reflect the true client IP that HAProxy communicated. Applications that read the remote IP for authorization or logging are directly affected.

The impact is limited to integrity of the reported address. Confidentiality and availability are not directly affected, according to the published CVSS vector.

Root Cause

The root cause lies in how Reactor Netty parses or applies the HAProxy Protocol header when resolving the remote peer address for a request. Under certain connection or configuration states, the server falls back to an incorrect source instead of the value declared in the HAProxy header. This is a configuration-dependent input validation issue and manifests only when HAProxy Protocol is explicitly enabled.

Attack Vector

The vulnerability is network reachable and requires no authentication or user interaction. An attacker who can send traffic to an affected Reactor Netty HTTP server, in a topology where HAProxy Protocol is enabled, may cause the server to record or act on an incorrect remote IP. This can weaken IP-based allow lists, evade rate limiting, or pollute audit logs used for incident response.

No verified exploit code is publicly available. See the Spring Security Advisory CVE-2026-47845 for vendor-supplied technical details.

Detection Methods for CVE-2026-47845

Indicators of Compromise

Mismatches between load balancer access logs and Reactor Netty application logs for the same request, especially divergent client IP fields.
Requests appearing to originate from internal or infrastructure IP ranges when they should carry an external client address forwarded by HAProxy.
Unexpected bypass of IP-based rate limits or allow lists in applications fronted by an HAProxy-style proxy.

Detection Strategies

Inventory all Reactor Netty deployments and identify which enable HAProxy Protocol via proxyProtocol(...) configuration on the HttpServer builder.
Compare the remote address surfaced by the application with the PROXY header value captured at the load balancer for a sample of requests.
Review Spring WebFlux and Reactor Netty dependency versions against the affected ranges using software composition analysis tooling.

Monitoring Recommendations

Alert on discrepancies between upstream proxy client IP telemetry and application-layer remote IP fields.
Monitor authentication and administrative endpoints for successful requests whose recorded source IP falls inside trusted infrastructure ranges without a matching proxy record.
Correlate access logs across the proxy tier and application tier in a centralized analytics platform to surface inconsistent IP attribution.

How to Mitigate CVE-2026-47845

Immediate Actions Required

Identify Reactor Netty versions in use and upgrade any instance within the affected ranges to a fixed release as listed in the Spring Security Advisory CVE-2026-47845.
Audit application code that consumes the remote IP address for security-relevant decisions such as authorization, allow listing, or abuse throttling.
Validate proxy topology so that only trusted load balancers can establish HAProxy Protocol connections to backend Reactor Netty servers.

Patch Information

Pivotal and the Spring team address the issue in updated Reactor Netty releases beyond the affected 1.3.6, 1.2.18, and 1.0.52 versions. Refer to the Spring Security Advisory CVE-2026-47845 for the specific fixed versions and upgrade guidance for Spring Boot and Spring Cloud Gateway consumers.

Workarounds

Disable HAProxy Protocol on the Reactor Netty HTTP server if the deployment does not require preserving the original client IP through TCP.
Terminate TLS and forward client IP using HTTP headers such as X-Forwarded-For from a trusted proxy instead of HAProxy Protocol, and validate those headers server side.
Restrict inbound network access to the Reactor Netty server so that only the intended HAProxy-capable load balancer can reach it, reducing the attacker surface for spoofed connections.

bash

# Configuration example: disable HAProxy Protocol on Reactor Netty HttpServer
# (Java pseudocode - apply within your Spring WebFlux server customizer)
# HttpServer.create()
#     .proxyProtocol(ProxyProtocolSupportType.OFF)
#     .bindNow();