CVE-2026-47844 in Reactor Netty
Summary
by MITRE • 08/26/2026
In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability in question involves a critical information disclosure flaw within the Reactor Netty HTTP Server, specifically affecting versions ranging from early releases up to version 1.3.6. This issue manifests when the server is configured with Brave Tracing, an open-source distributed tracing system widely used for monitoring and troubleshooting microservices architectures. The core technical flaw lies in how exception handling interacts with request context propagation across asynchronous I/O operations. In a reactive programming model like that employed by Reactor Netty, requests are processed through non-blocking event loops where state management is complex. When an error occurs during the processing of one request, improper cleanup or isolation of the tracing context can cause sensitive internal details from that failed operation to persist in memory structures associated with subsequent, unrelated client connections.
This cross-request leakage means that diagnostic information such as stack traces, database query errors, or configuration paths intended for debugging a specific failure may be inadvertently exposed to other users connecting to the same server instance. For example, if an internal service call fails and throws an exception containing sensitive backend logic details, this data could potentially be included in error responses sent to different clients who have no relation to the original failing request. This represents a significant breach of isolation principles inherent in multi-tenant or public-facing web services, where each request should remain independent regarding state and output content.
From a security taxonomy perspective, this vulnerability aligns with CWE-209: Generation of Error Message Containing Sensitive Information. The exposure occurs because the application generates an error message that includes internal implementation details which could aid attackers in further exploitation or reconnaissance. Furthermore, within the MITRE ATT&CK framework, this behavior can be categorized under T1530: Data from Local System, as it involves accessing and potentially exfiltrating data stored on the system through improper handling of runtime exceptions. The attack vector is typically remote, requiring only a network connection to the vulnerable server endpoint that triggers an error condition while Brave Tracing is active.
The operational impact of this vulnerability extends beyond mere information leakage. It can facilitate more sophisticated attacks by providing attackers with insights into the underlying technology stack, version numbers, and internal architecture patterns. This intelligence allows adversaries to tailor subsequent exploits against known vulnerabilities in those specific components or to craft targeted phishing campaigns based on revealed organizational structures. Additionally, it violates compliance requirements for data protection regulations such as GDPR or HIPAA if the leaked exception details contain personally identifiable information or protected health information embedded within stack traces or error payloads.
Mitigation strategies primarily involve upgrading Reactor Netty to a patched version where this context isolation issue has been resolved. For organizations unable to upgrade immediately, applying strict input validation and ensuring that custom error handlers do not rely on global tracing contexts for generating response bodies can reduce exposure. It is also advisable to review Brave Tracing configurations to ensure that sensitive data is masked or excluded from trace spans before they are processed by the HTTP server layer. Regular security audits of logging mechanisms and exception handling routines in reactive applications are essential to prevent similar context leakage issues in other parts of the system architecture.