Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-47844 EUVD-2026-66679GHSA-xcw7-34p4-wrp4

Reactor Netty HTTP Server Leaks Exception Details

Published Aug 26, 2026 · Updated Aug 26, 2026 · Assigned by vmware

Description

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing.
Reactor Netty 1.3.0 - 1.3.6
Reactor Netty 1.1.0 - 1.2.18
Reactor Netty 1.0.52 and earlier

Affected products

VendorProductAffectedFixed
Spring Reactor Netty 1.3.0 – ≤ 1.3.6, 1.1.0 – ≤ 1.2.18, ≤ 1.0.52 —

References