# CVE-2026-47845: Project Reactor Netty HTTP Server incorrect remote IP evaluation with HAProxy Protocol

Source: https://junglewise.ai/threats/cve-2026-47845-project-reactor-netty-http-server-incorrect-remote-ip-evaluation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-47845 · Severity: medium · CVSS 5.3 · Published 2026-08-27

Reactor Netty HTTP Server, a networking library used in reactive Java applications, may incorrectly identify the source IP address of incoming requests when HAProxy Protocol is enabled. This misconfiguration could allow attackers to spoof their IP address and bypass IP-based access controls, rate limiting, or logging mechanisms that rely on accurate source IP identification.

## Quick answers

**Is CVE-2026-47845 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47845 being exploited in the wild.

**How severe is CVE-2026-47845?** Medium severity, with a CVSS score of 5.3, published 27 August 2026.

**Which products and versions are affected?** Project Reactor Reactor Netty 1.0.52 and earlier, 1.1.0–1.2.18, 1.3.0–1.3.6.

**Is there a fix for CVE-2026-47845?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47845 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47845?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication/access control bypass in Reactor Netty's HAProxy Protocol handler, where the remote IP address is incorrectly evaluated in specific scenarios. The flaw exists in versions 1.0.52 and earlier, 1.1.0–1.2.18, and 1.3.0–1.3.6. It requires the application to explicitly enable HAProxy Protocol support. An attacker with network access to the application can craft a malicious HAProxy Protocol header to spoof a remote IP address, potentially bypassing IP-based security controls, rate limiters, or audit logging. Patches are available in later versions.

## Affected products

- Project Reactor Reactor Netty 1.0.52 and earlier, 1.1.0–1.2.18, 1.3.0–1.3.6

## Timeline

- 2026-08-27: disclosed

## References

- [https://spring.io/security/cve-2026-47845](https://spring.io/security/cve-2026-47845)