CVE-2026-47845 in Reactor Netty
Summary
by MITRE • 08/27/2026
In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability in question resides within the HTTP server implementation of Reactor Netty, specifically affecting versions ranging from 1.0.52 through 1.3.6. This flaw is triggered exclusively when the application is explicitly configured to utilize the HAProxy Protocol for handling incoming connections. The core technical deficiency involves an incorrect evaluation or parsing logic regarding the remote IP address extracted from the HAProxy protocol payload. When a client connects via a proxy that supports this protocol, such as HAProxy itself, the server relies on the protocol's header data to determine the true source of the request rather than relying solely on the TCP connection endpoint. However, due to the identified flaw in these specific versions, Reactor Netty fails to accurately process or validate this information under certain conditions, leading to a discrepancy between the actual client IP and the IP address recorded by the application logic.
From an operational perspective, this misidentification of the remote peer has significant implications for security monitoring and access control mechanisms that depend on accurate source identification. Many enterprise applications utilize the client's IP address as a primary factor in rate limiting policies, geographic restrictions, fraud detection systems, and audit logging. If the server incorrectly evaluates the remote IP, it may inadvertently allow traffic from unauthorized sources or block legitimate users based on flawed data. Furthermore, this issue can compromise the integrity of security logs, making forensic analysis difficult during incident response scenarios where accurate attribution of network events is critical for determining the scope and origin of an attack.
This vulnerability aligns with CWE-200, which categorizes exposure of sensitive information to unauthorized actors, as well as CWE-781, regarding improper address validation in protocols that rely on external headers for identity verification. In the context of the MITRE ATT&CK framework, this flaw facilitates techniques associated with IP spoofing and evasion, specifically under Tactic TA0005 (Defense Evasion) where an adversary might exploit misconfigured or flawed proxy handling to mask their true origin. It also impacts visibility within the Detection category by corrupting telemetry data that security operations centers rely upon for threat hunting.
To mitigate this risk, organizations running affected versions of Reactor Netty must upgrade immediately to a patched version outside the specified vulnerable ranges. Developers should verify their build configurations and dependency management tools to ensure that no legacy or unpatched artifacts remain in production environments. Additionally, until an upgrade is feasible, implementing additional validation layers at the network perimeter using next-generation firewalls can help enforce stricter IP-based policies independent of application-level logic. It is also advisable to review logging mechanisms to identify any anomalies in source IP attribution and to consider deploying Web Application Firewalls that perform deep packet inspection on HAProxy protocol headers to ensure consistency between transport-layer metadata and application-layer expectations.