CLEANSTART-2026-GZ46020 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the trino package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CLEANSTART-2026-ES91240 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

PT-2026-122726

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CLEANSTART-2026-JY60048 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CLEANSTART-2026-ZC51583 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

PT-2026-108592

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

Incorrect Remote IP Address Evaluation

Reactor Netty is vulnerable to an Incorrect Remote IP Address Evaluation. The vulnerability is due to improper evaluation of the remote IP address when the HAProxy Protocol is enabled, which may allow an attacker to spoof or manipulate the perceived client IP address under specific configurations...

EUVD-2026-66819

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47845

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47845: Authentication Bypass by Spoofing

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47845 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47845

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47845 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47845

Reactor Netty HTTP Server may incorrectly evaluate the remote IP address in specific scenarios when the HAProxy Protocol is enabled, allowing a client to spoof the reported source address. Affected versions are 1.3.0–1.3.6 , 1.1.0–1.2.18 , and 1.0.52 and earlier . The vulnerability is rated CVSS ...

PT-2026-82347

Name of the Vulnerable Software and Affected Versions Reactor Netty versions 1.0.0 through 1.0.52 Reactor Netty versions 1.1.0 through 1.2.18 Reactor Netty versions 1.3.0 through 1.3.6 Description When the HAProxy Protocol is enabled, the HTTP Server may incorrectly evaluate the remote IP address...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation in the evaluation of the remote IP address when the HAProxy Protocol is enabled. An attacker can bypass IP-based access controls by sending specially crafted requests. Note: This is only exploitable if the application...

Uncontrolled Resource Consumption (Denial Of Service)

Netty is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to improper handling of the HAProxy protocol version byte in the HAProxyMessageDecoder, where a signed Java byte is widened to an int without masking, causing a crafted 0xFF version byte to be...

CVE-2026-59919 Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder HAProxyMessageEncoder writes AFUNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF...

CVE-2026-59919 Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder HAProxyMessageEncoder writes AFUNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF...

CVE-2026-59919

Netty CVE-2026-59919 affects the HAProxy encoder (HAProxyMessageEncoder) in Netty versions prior to 4.1.136.Final and 4.2.16.Final. The encoder writes AF_UNIX source/destination addresses into the HAProxy V1 text protocol without validating for CRLF, allowing an attacker who controls an AF_UNIX a...