CVE-2026-47844

Received Received - Intake

Information Leak in Reactor Netty HTTP Server

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VMware

Description

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-47844

Affected Vendors & Products

Vendor	Product	Version / Range
reactor_netty	reactor_netty	From 1.3.0 (inc) to 1.3.6 (inc)
reactor_netty	reactor_netty	From 1.1.0 (inc) to 1.2.18 (inc)
reactor_netty	reactor_netty	to 1.0.52 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves Reactor Netty HTTP Server leaking exception details across unrelated requests when configured with Brave Tracing. It affects specific versions of Reactor Netty.

Detection Guidance

To detect this vulnerability, check if your Reactor Netty HTTP Server is running versions 1.3.0-1.3.6, 1.1.0-1.2.18, or 1.0.52 and earlier. Verify if Brave Tracing is enabled in the server configuration. Monitor logs for leaked exception details across unrelated requests.

Impact Analysis

The impact includes potential information leakage between unrelated requests, which could expose sensitive data or internal errors to unintended users.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it only leaks exception details across unrelated requests when Brave Tracing is configured. No evidence suggests it exposes sensitive data or violates these standards.

Mitigation Strategies

Update Reactor Netty to a version that fixes the issue. For Reactor Netty 1.3.x, upgrade to 1.3.7 or later. For 1.2.x, upgrade to 1.2.19 or later. For 1.0.x, upgrade to 1.0.53 or later. Disable Brave Tracing if not required.

Hi! I’m here to help you understand CVE-2026-47844. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70