CLEANSTART-2026-GZ46020 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the trino package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CLEANSTART-2026-ES91240 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

PT-2026-122726

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CLEANSTART-2026-JY60048 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CLEANSTART-2026-ZC51583 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CLEANSTART-2026-CQ96086 In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials

Security vulnerability affects the elasticsearch package. In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials...

PT-2026-108592

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

PT-2026-108375

Security vulnerability affects the elasticsearch package. In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials...

Denial-of-service (DoS)

io.projectreactor.netty, reactor-netty-http is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of multiple pipelined HTTP/1.1 requests over a single connection, which allows an attacker to send specially crafted requests that consume excessive memory and...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.7) +1150 more potentially affected by CVE-2026-47845 via io.projectreactor.netty:reactor-netty-http (>=1.3.0, <=1.3.6)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =1.5.0, =1.5.0, =1.7.0 and more Source cves: CVE-2026-47845 Source advisory: MEND:CVE-2026-47845...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.7) +1150 more potentially affected by CVE-2026-47848 via io.projectreactor.netty:reactor-netty-http (>=1.3.0, <=1.3.6)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =1.5.0, =1.5.0, =1.7.0 and more Source cves: CVE-2026-47848 Source advisory: MEND:CVE-2026-47848...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.ancf.lmos-router:benchmarks (>=0.2.0, <=0.28.0) +6712 more potentially affected by CVE-2026-47848 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.3.6)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm 0.1.0...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.ancf.lmos-router:benchmarks (>=0.2.0, <=0.28.0) +6712 more potentially affected by CVE-2026-47845 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.3.6)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm 0.1.0...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.ancf.lmos-router:benchmarks (>=0.2.0, <=0.28.0) +6712 more potentially affected by CVE-2026-47874 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.3.6)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm 0.1.0...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect in scenarios where a WebSocket handshake is redirected to a different origin and the HTTP client is explicitly configured to follow redirects. An attacker can obtain sensitive credentials by leveraging crafted redirect...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the process handling HTTP requests when Brave Tracing is enabled. An attacker can obtain sensitive exception details from unrelated requests by sending crafted requests to the server. This is only exploitable if...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation in the evaluation of the remote IP address when the HAProxy Protocol is enabled. An attacker can bypass IP-based access controls by sending specially crafted requests. Note: This is only exploitable if the application...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handling of HTTP/1.1 pipelined requests over a single connection. An attacker can cause excessive memory consumption by sending multiple pipelined requests, potentially leading...

ROOT-APP-MAVEN-CVE-2023-34062 CVE-2023-34062 in io.root.io.projectreactor.netty:reactor-netty-http - Patched by Root

Root has patched CVE-2023-34062 in the io.root.io.projectreactor.netty:reactor-netty-http package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-22227 CVE-2025-22227 in io.root.io.projectreactor.netty:reactor-netty-http - Patched by Root

Root has patched CVE-2025-22227 in the io.root.io.projectreactor.netty:reactor-netty-http package for Root:Maven. Multiple fixed versions available...