Reactor Netty CVE-2026-47845

Exploitation requires that the target Reactor Netty HTTP Server application has explicitly enabled HAProxy PROXY Protocol parsing in its configuration - this is not the default behavior. The attacker must be able to reach the Reactor Netty backend with a TCP connection carrying a crafted or spoofed PROXY Protocol header; in well-architected deployments, only the HAProxy tier should be able to reach the backend, which limits exposure. The vulnerability does not require authentication (CVSS PR:N), requires no user interaction (UI:N), and operates over the network (AV:N). Limiting factors are the mandatory non-default HAProxy Protocol configuration and any network segmentation between the public internet and the backend service. Deployments where the Reactor Netty process is directly internet-exposed with PROXY Protocol enabled are at greatest risk.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly frames this as a moderate-severity, network-reachable integrity issue. The attack complexity is low in the sense that no authentication is required to influence the PROXY Protocol header on a misrouted or attacker-controlled connection. However, real-world exploitability is gated by a mandatory non-default configuration: HAProxy Protocol must be explicitly enabled. Organizations not using HAProxy or a PROXY-Protocol-capable load balancer are not affected. The practical risk concentrates in deployments using IP-based access control, fraud detection, or audit trails, where a spoofed source IP could enable bypass of controls or false attribution. EPSS data is not available in the provided intelligence. No KEV listing and no POC code exists, and the tagged 'Information Disclosure' impact is consistent with an attacker learning what IP the server attributes to them rather than extracting sensitive server-side data. This is a real but bounded risk - not a critical priority for most organizations, but genuinely significant for any Reactor Netty deployment where IP identity is a security control.

An attacker with network access to a Reactor Netty service protected by an HAProxy load balancer sends a crafted TCP connection carrying a malformed or spoofed PROXY Protocol header. Due to the parsing flaw, the server interprets the attacker's source IP as a different, possibly trusted, address. This allows the attacker to appear to originate from an allowlisted IP range, bypassing rate limits, IP-based access controls, or skewing audit logs. No confirmed POC exists at time of analysis.