CVE-2026-47844

EUVD-2026-66679
In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing.
Reactor Netty 1.3.0 - 1.3.6
Reactor Netty 1.1.0 - 1.2.18
Reactor Netty 1.0.52 and earlier
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 14.29%
Affected Products (NVD)
VendorProductVersion
broadcomreactor_netty
𝑥
< 1.0.53
broadcomreactor_netty
1.1.0 ≤
𝑥
< 1.2.19
broadcomreactor_netty
1.3.0 ≤
𝑥
< 1.3.6.1
𝑥
= Vulnerable software versions
References
https://spring.io/security/cve-2026-47844