{"id":"CVE-2026-47844","aliases":["CLSA-2026-1791529633","CLSA-2026-1791547948","CLSA-2026-1791989666","CLSA-2026-1792505040","CLSA-2026-1793116571","CLSA-2026-1793345120","EUVD-2026-66679","GHSA-xcw7-34p4-wrp4"],"status":"published","title":"Reactor Netty HTTP Server Leaks Exception Details","description":"In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00243,"percentile":0.15558,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-08-26T19:22:25Z","modified":"2026-11-02T19:46:31Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8}],"products":[{"vendor":"broadcom","product":"reactor_netty"},{"vendor":"spring","product":"reactor netty"},{"vendor":"vmware","product":"reactor netty"}],"references":[{"url":"https://spring.io/security/cve-2026-47844","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47844"},{"url":"https://github.com/advisories/GHSA-xcw7-34p4-wrp4"}],"sources":{"cve":[{"id":"CVE-2026-47844","title":"Reactor Netty HTTP Server Leaks Exception Details","description":"In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T19:22:25.677Z","modified":"2026-08-26T19:44:53.514Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-66679","description":"In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T19:22:25Z","modified":"2026-08-26T19:44:53Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:29.296861Z"}],"ghsa":[{"id":"GHSA-xcw7-34p4-wrp4","title":"In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated...","description":"In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T21:31:43Z","modified":"2026-08-26T21:31:52Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:11:01.362113Z"}],"nvd":[{"id":"CVE-2026-47844","description":"In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T20:17:26.637Z","modified":"2026-09-04T19:10:33.817Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CLSA-2026-1791529633","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.1.31-tuxcare.4.","status":"published","published":"2026-10-09T07:07:13Z","modified":"2026-11-02T19:46:27.100145141Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791547948","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.48-tuxcare.5.","status":"published","published":"2026-10-09T12:12:28Z","modified":"2026-11-02T19:46:26.379358987Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791989666","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.2.18-tuxcare.2.","status":"published","published":"2026-10-14T14:54:26Z","modified":"2026-11-02T19:46:27.828680262Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792505040","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.32-tuxcare.6.","status":"published","published":"2026-10-20T14:04:00Z","modified":"2026-11-02T19:46:29.903938891Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793116571","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.1.15-tuxcare.3.","status":"published","published":"2026-10-27T15:56:11Z","modified":"2026-11-02T19:46:31.80652923Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793345120","title":"TuxCare security update for io.projectreactor.netty (8 CVEs)","description":"TuxCare rebuilt 4 io.projectreactor.netty packages to address 8 CVEs. Fixed in 1.0.34-tuxcare.1.","status":"published","published":"2026-10-30T08:25:21Z","modified":"2026-10-30T13:30:08.72554284Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}