Executive brief
Reactor Netty HTTP Server, a networking library used in reactive Java applications, may incorrectly identify the source IP address of incoming requests when HAProxy Protocol is enabled. This misconfiguration could allow attackers to spoof their IP address and bypass IP-based access controls, rate limiting, or logging mechanisms that rely on accurate source IP identification.
Technical details
The vulnerability is an authentication/access control bypass in Reactor Netty's HAProxy Protocol handler, where the remote IP address is incorrectly evaluated in specific scenarios. The flaw exists in versions 1.0.52 and earlier, 1.1.0–1.2.18, and 1.3.0–1.3.6. It requires the application to explicitly enable HAProxy Protocol support. An attacker with network access to the application can craft a malicious HAProxy Protocol header to spoof a remote IP address, potentially bypassing IP-based security controls, rate limiters, or audit logging. Patches are available in later versions.
Affected products
- Project Reactor Reactor Netty 1.0.52 and earlier, 1.1.0–1.2.18, 1.3.0–1.3.6
Timeline
- 2026-08-27: disclosed