CVE-2026-47845 — Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

CVE-2026-47845

Reactor Netty HTTP Server may incorrectly evaluate proxy addresses PUBLISHED

Description (CNA)

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Reactor Netty	affected 1.3.0 through 1.3.6; affected 1.1.0 through 1.2.18; affected 0 through 1.0.52

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-47845

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.