Reactor Netty CVE-2026-47844

Exploitation requires that the target Reactor Netty HTTP Server instance is configured with Brave Tracing integration - this is a non-default, operator-applied configuration. The vulnerability does not manifest in default Reactor Netty deployments without Brave Tracing. Additionally, the description specifies 'specific scenarios,' implying that not every request under a Brave-Tracing-enabled server triggers the leakage - the exact triggering conditions (e.g., exception type, request ordering, concurrency) are not specified in available data. What limits exploitation: the Brave Tracing configuration prerequisite significantly narrows the exposed population; the leakage is passive (the attacker receives information rather than executing code); and the impact is bounded to whatever exception details the server generates, which may or may not contain sensitive data depending on application error handling.

The CVSS 5.3 base score reflects a moderate, network-accessible vulnerability with no authentication required and low attack complexity once the prerequisite configuration is in place. However, the official vector assigns I:L (Integrity Low) with C:N (no confidentiality impact), which is atypical for an information disclosure flaw - exception detail leakage is conventionally a confidentiality concern, and this metric assignment warrants independent verification against the vendor advisory. No EPSS score was provided in the input data; exploitation probability cannot be quantified from available signals. The absence of a CISA KEV entry and any public POC means this is an unconfirmed-in-the-wild issue at the time of analysis. The most significant risk limiter is the Brave Tracing configuration prerequisite - organizations not using distributed tracing with this specific library are not exposed. Deployments that do use Brave Tracing with Reactor Netty should prioritize patching given the ease of network access once the condition is met, and even a small internal platform team supporting reactive Spring services should treat this as a straightforward patch cycle rather than an emergency response.

An attacker sends crafted HTTP requests to a Reactor Netty server that has Brave Tracing enabled, then observes responses for subsequent requests that inadvertently contain exception details from prior request processing. The leaked exception metadata may reveal internal class names, stack traces, configuration paths, or other diagnostic information useful for reconnaissance. No public proof-of-concept has been identified, but the attack requires no authentication and no special attacker tooling beyond standard HTTP clients.