CLEANSTART-2026-GT11567 In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials

Security vulnerability affects the elasticsearch package. In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials...

CLEANSTART-2026-JY60048 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CLEANSTART-2026-CL63424 In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver

Security vulnerability affects the elasticsearch package. In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver...

Security Bulletin: Vulnerabilities in Netty,jackson-databind,Angular,bootstrap,React Router,decode-uri-component,Reactor Netty,Spring WebFlux,Spring Framework,spring-web might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, jackson-databind, Angular, bootstrap, React Router, decode-uri-component, Reactor Netty, Spring WebFlux, Spring Framework,spring-web. Vulnerabilities include allowing the renamed JSON key to be assigned...

CLEANSTART-2026-ZC51583 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CLEANSTART-2026-DT37851 In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials

Security vulnerability affects the elasticsearch package. In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials...

CLEANSTART-2026-IJ88105 In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver

Security vulnerability affects the elasticsearch package. In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver...

CLEANSTART-2026-CQ96086 In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials

Security vulnerability affects the elasticsearch package. In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials...

CVE-2026-47843

A flaw was found in Reactor Netty. In specific scenarios, when multiple clients use different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. This can lead to traffic being routed incorrectly, potentially impacting the intended destination of...

CVE-2026-47874

A flaw was found in the Reactor Netty HTTP server. A remote attacker can exploit this vulnerability by sending HTTP/1.1 pipelined requests over a single connection. This action causes the server to consume an excessive amount of memory, leading to a Denial of Service DoS...

Security Bulletin: Vilunarabilities found in reactor-netty-http-1.2.13.jar in APIM

Summary reactor-netty-http-1.2.13.jar - In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. These are addressed in IBM webMethods Developer Portal and IBM webMethods API ControlPlane Vulnerability Details...

Denial-of-service (DoS)

io.projectreactor.netty, reactor-netty-http is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of multiple pipelined HTTP/1.1 requests over a single connection, which allows an attacker to send specially crafted requests that consume excessive memory and...

Improper Credential Management

Reactor Netty is vulnerable to Improper Credential Management. The vulnerability is due to credentials being forwarded during WebSocket handshake redirects to a different origin when redirects are explicitly enabled, which allows an attacker to intercept or obtain sensitive credentials...

Incorrect Remote IP Address Evaluation

Reactor Netty is vulnerable to an Incorrect Remote IP Address Evaluation. The vulnerability is due to improper evaluation of the remote IP address when the HAProxy Protocol is enabled, which may allow an attacker to spoof or manipulate the perceived client IP address under specific configurations...

DNS Resolver Configuration Reuse

io.projectreactor.netty, reactor-netty-core is vulnerable to DNS Resolver Configuration Reuse. The vulnerability is due to the incorrect reuse of a previously configured DNS resolver between clients with different DNS resolver configurations, which allows an attacker to potentially influence DNS...

EUVD-2026-66819

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

EUVD-2026-66831

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-47874

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-47845

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47874: Allocation of Resources Without Limits or Throttling

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...