CLEANSTART-2026-JY60048 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

🗓️ 08 Oct 2026 00:42:44Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Incorrect remote IP address evaluation in Elasticsearch Reactor Netty HTTP Server.

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	28 Sep 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for Sept 2026 - Multiple CVEs addressed	1 Oct 202606:14	–	ibm
CVE	CVE-2026-47845	26 Aug 202623:28	–	cve
Cvelist	CVE-2026-47845 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses	26 Aug 202623:28	–	cvelist
EUVD	EUVD-2026-66819	27 Aug 202603:32	–	euvd
Mend	CVE-2026-47845	26 Aug 202623:28	–	mend
NVD	CVE-2026-47845	27 Aug 202601:17	–	nvd
OSV	CLEANSTART-2026-EC45528 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5	10 Sep 202602:58	–	osv
OSV	CLEANSTART-2026-HS64071 Security fix for CVE-2026-47845 applied in: apache-nifi 2.10.0-r8	18 Sep 202609:28	–	osv
OSV	CLEANSTART-2026-ZC51583 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled	29 Sep 202600:34	–	osv

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JY60048.json
osv	www.osv.dev/vulnerability/CVE-2026-47845
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-47845

08 Oct 2026 16:47Current

6Medium risk

Vulners AI Score6

CVSS 3.15.3

EPSS0.00294

Elasticsearch Reactor Netty HTTP Server HAProxy Protocol