Executive brief
Spring Reactor Netty is a non-blocking HTTP server library used in Spring Boot applications. Under specific configurations involving Brave Tracing, the server may leak sensitive exception details from one request across to unrelated requests, potentially exposing error messages containing internal system information or other sensitive data to clients who did not trigger the original exception.
Technical details
This vulnerability is an information disclosure issue in the Reactor Netty HTTP Server where exception details may leak across unrelated HTTP requests. The vulnerability occurs when the server is configured with Brave Tracing integration enabled. The attack vector is network-based with no authentication required—any HTTP client can trigger the condition. An attacker can receive exception details intended for a different request, potentially revealing internal system architecture, configuration, or other sensitive information. Patches are available in Reactor Netty 1.3.7 and later, and in the 1.2.x branch from version 1.2.19 onward.
Affected products
- Spring Reactor Netty 1.0.52 and earlier, 1.1.0 through 1.2.18, 1.3.0 through 1.3.6
Timeline
- 2026-08-26: disclosed