SB20260828206 - Multiple vulnerabilities in Reactor Netty

Description

This security bulletin contains information about 5 vulnerabilities.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-47843)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to route traffic to unintended destinations.

The vulnerability exists due to improper resource management in DNS resolver handling when dynamically creating multiple clients with different custom DNS resolver configurations. A remote attacker can trigger reuse of a previously configured DNS resolver to route traffic to unintended destinations.

The issue occurs in specific scenarios involving multiple clients such as HttpClient or TcpClient that rely on different custom configuration.

2) Information disclosure (CVE-ID: CVE-2026-47844)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify application behavior by causing exception details to be leaked across unrelated requests.

The vulnerability exists due to improper isolation of exception details in the Reactor Netty HTTP Server when handling requests. A remote attacker can send a request that triggers an exception to modify application behavior by causing exception details to be leaked across unrelated requests.

Only servers configured with Brave Tracing are vulnerable.

3) Input validation error (CVE-ID: CVE-2026-47845)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to affect the integrity of IP-based access control decisions.

The vulnerability exists due to improper input validation in Reactor Netty HTTP Server HAProxy Protocol address handling when processing proxied connections. A remote attacker can send a specially crafted proxied connection to affect the integrity of IP-based access control decisions.

The issue occurs only when the application is configured to use HAProxy Protocol.

4) Information disclosure (CVE-ID: CVE-2026-47848)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper handling of credential forwarding in the Reactor Netty WebSocket client when processing WebSocket handshake redirects to a different origin. A remote attacker can trigger a crafted redirect during the WebSocket handshake to disclose sensitive information.

The HTTP client must be explicitly configured to follow redirects, and user interaction is required.

5) Resource exhaustion (CVE-ID: CVE-2026-47874)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory consumption in Reactor Netty HTTP server when processing HTTP/1.1 pipelined requests over a single connection. A remote attacker can send pipelined requests over a single connection to cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://spring.io/security/cve-2026-47843
• https://spring.io/security/cve-2026-47844
• https://spring.io/security/cve-2026-47845
• https://spring.io/security/cve-2026-47848
• https://spring.io/security/cve-2026-47874