CVE-2026-47844

Executive Summary

CVE-2026-47844 is an information disclosure vulnerability in the Reactor Netty HTTP Server that occurs only when the server is configured with Brave Tracing enabled. In specific scenarios, exception details are leaked across unrelated requests, potentially exposing sensitive stack traces, internal paths, or configuration information to unauthenticated remote attackers. The vulnerability affects Reactor Netty versions 1.3.0 – 1.3.6, 1.1.0 – 1.2.18, and 1.0.52 and earlier. The CVSS score is 5.3 (Medium), indicating an integrity impact with no confidentiality or availability impact, and no authentication is required for exploitation. No patch is currently available, and no public exploit or PoC exists at the time of writing.

Technical Analysis

The Reactor Netty HTTP Server is a reactive, non-blocking network framework built on top of Netty, commonly used as the embedded web server in Spring Boot applications to serve REST APIs and microservices. The vulnerability manifests exclusively when the server is configured with Brave Tracing, a distributed tracing library that instruments HTTP requests to propagate trace and span contexts for observability platforms such as Zipkin or Jaeger.

Based on the NVD description, the flaw lies in the interaction between the trace instrumentation and the HTTP request processing pipeline. Brave Tracing typically wraps request handling in a tracing context that captures span metadata, including exception information, for reporting to the tracing backend. Under specific conditions — likely involving asynchronous completion paths or error-handling callbacks — the tracing context incorrectly associates exception details from one request with a different, concurrent or subsequent request.

The leak mechanism is an exception detail cross-contamination: because the trace context is bound to the execution thread or the request lifecycle in a manner that is not properly isolated between requests, error information from request A (e.g., stack trace fragments, exception class names, or internal error messages) can be included in the HTTP response or in the tracing data associated with request B. This violates the isolation boundary between independent HTTP requests and exposes internal implementation details to the client that initiated the unrelated request.

The attack surface is the HTTP request/response cycle. Since the vulnerability does not require authentication (PR:N) and can be triggered over the network (AV:N), any unauthenticated client that can reach the HTTP server can potentially induce the leakage by sending requests designed to cause exceptions (e.g., malformed inputs, requests to nonexistent endpoints, or requests that trigger application-level errors). The leak is observed in the response body or headers returned to the client.

It should be noted that the NVD description does not specify the exact code-level mechanism, such as which class or method is responsible, nor does it identify the precise condition ("specific scenarios") required for the leak to occur. Insufficient technical detail is available to pinpoint the root-cause function. However, given the dependency on Brave Tracing, the vulnerability class is best characterized as improper handling of sensitive trace/span data leading to information disclosure across isolation boundaries. This is conceptually similar to CWE-209 (Generation of Error Message Containing Sensitive Information) but with a cross-request contamination vector, which is more accurately classified under CWE-248 (Uncaught Exception) or CWE-488 (Exposure of Data Element to Wrong Session). The absence of a formal CWE assignment from the NVD data suggests that the flaw does not fit neatly into a single classification.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

Attack Chain Steps:

1. Reconnaissance / Target Identification. An attacker identifies a public-facing application that uses Reactor Netty as its HTTP server. Fingerprinting can be done via the Server HTTP header, which defaults to ReactorNetty (e.g., Server: ReactorNetty/1.3.0). Alternatively, the attacker can probe the application with malformed requests to observe error response patterns that reveal the server framework. The attacker must also determine whether Brave Tracing is enabled — this may be inferred from exposed tracing endpoints (e.g., /actuator/trace, /zipkin), or by observing that error responses contain trace/span IDs in headers.

2. Triggering the Flaw. The attacker sends a series of HTTP requests designed to generate exceptions. Examples at the vulnerability-class level include: requests with malformed headers, invalid content types, oversized payloads to trigger buffer overflows or decoding errors, requests to nonexistent resources that produce 404 Not Found but generate internal NoResourceFoundException tracing events, or requests with invalid query parameters that cause application-level validation exceptions. The goal is to populate the tracing context with exception details for at least one request (request A) and concurrently or subsequently send a benign request (request B) from a different session or after a specific timing offset.

3. Payload / Execution Method. Since this is not a memory-corruption or injection vulnerability, there is no payload to deliver in the traditional sense. The attacker's "payload" is the error-inducing request itself. The vulnerability is triggered when the Brave Tracing instrumentation fails to properly unbind the trace context after request A completes, causing exception details captured for request A to be emitted in the response to request B. The exact condition ("specific scenarios") is not publicly documented, but it is likely timing-dependent (race condition) or related to thread-pool task reuse where the trace context is stored in a thread-local variable that is not cleared.

4. Post-Exploitation Impact. Once the leak occurs, the attacker obtains internal exception details of the application. This may include: fully qualified exception class names (revealing the Java package structure and framework versions), stack trace fragments (revealing internal class names, method names, and possibly file paths on the server), database error messages (revealing SQL dialect or connection string fragments), or framework-specific error codes. This information can be used to map the application's internals, identify additional vulnerabilities, or craft more targeted attacks. The integrity impact (I:L) in the CVSS score suggests the leaked information can be tampered with or can influence the attacker's subsequent actions, although the confidentiality impact is scored as none, which is unusual — this may indicate that the leaked exception data is not considered sensitive by the CVSS scoring guideline, or that the leak is inconsistent/intermittent.

Impact Assessment

Business Impact. The vulnerability enables information disclosure that can aid in further attacks. For enterprise applications, leaked stack traces can expose internal network paths, class names, library versions, and in some cases, hardcoded credentials or connection strings embedded in exception messages (e.g., a JDBC URL containing a username). This lowers the barrier for targeted exploitation of other vulnerabilities. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects a Medium severity of 5.3, driven primarily by the network attack vector and lack of authentication. The confidentiality impact is scored as N (None), which is puzzling for an information leak; this may indicate that the leaked data is not considered sensitive under CVSS definitions, or that the leak is partial and inconsistent. The availability impact is N, so no denial-of-service is possible.

Affected Systems. Any production system running Reactor Netty 1.3.0 – 1.3.6, 1.1.0 – 1.2.18, or 1.0.52 and earlier, with Brave Tracing explicitly enabled in the application configuration (e.g., via spring.sleuth.brave.enabled=true or manual Brave instrumentation). This includes Spring Boot 3.x and 2.x microservices that use Reactor Netty as the embedded server and have distributed tracing enabled.

Blast Radius. The blast radius is limited to the information-bearing responses. However, in microservice architectures with a public API gateway fronting Reactor Netty services, the leak can be observed by any unauthenticated external client. The scope is Unchanged (S:U), meaning the compromised component (Reactor Netty) does not affect other security boundaries.

Weaponization Potential. Because no PoC or exploit exists and the exact trigger condition is unknown, weaponization is currently theoretical. However, the "specific scenarios" language suggests that the trigger may be deterministic under certain traffic patterns (e.g., high concurrency), and an attacker could potentially script the attack using automated fuzzing to induce exceptions and observe responses for leaked data.

Detection Guidance

The following detection rules target the information disclosure pattern and the anomalous error-response behavior. Since the vulnerability is server-side and may not produce unique network signatures, the rules focus on detecting error responses with unexpected content, trace/span header anomalies, and abnormal error rates.

Sigma Rule

title: Reactor Netty Cross-Request Exception Leak Detection
id: 7c2a1f5e-9b83-4d6a-8f2e-1c9d0e4a5b6f
status: experimental
description: Detects HTTP responses from Reactor Netty servers containing exception stack traces when Brave Tracing is enabled, indicating potential CVE-2026-47844 exploitation.
logsource:
  category: webserver
  product: generic
detection:
  selection_headers:
    - 'Server|startswith': 'ReactorNetty'
  selection_exception:
    - 'response_body|contains': 'Exception'
    - 'response_body|contains': 'at org.springframework'
    - 'response_body|contains': 'reactor.netty'
  selection_success:
    - 'status_code': '200'
    - 'status_code': '201'
    - 'status_code': '204'
  timeframe: 1m
  condition: selection_headers and selection_exception and selection_success
falsepositives:
  - Application intentionally exposing error details in response bodies (misconfiguration)
  - Dev/test environments with full stack trace display
fields:
  - client_ip
  - server_host
  - url_path
  - response_body
level: medium

YARA Rule

rule ReactorNetty_Exception_Leak_CVE_2026_47844
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects HTTP response bodies containing cross-request leaked exception details from Reactor Netty servers"
        cve = "CVE-2026-47844"
        severity = "medium"
    strings:
        $s1 = "reactor.netty" ascii
        $s2 = "Brave" ascii
        $s3 = "spanId" ascii
        $s4 = "traceId" ascii
        $s5 = "Exception" ascii wide
        $s6 = "Caused by:" ascii
        $s7 = "at " ascii // stack trace frame marker
    condition:
        uint16(0) == 0x0D0A and // HTTP header terminator suggests raw capture
        (1 of ($s1, $s2, $s3, $s4)) and
        (2 of ($s5, $s6, $s7))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET INFO Reactor Netty Exception Leak CVE-2026-47844 Attempt";
    flow:established,to_server;
    content:"Server"; http_header;
    content:"ReactorNetty"; http_header;
    nocase;
    content:"Exception"; http_response_body;
    nocase;
    pcre:"/(?:java\.lang\.\w+Exception|at\s+[a-zA-Z0-9_\.]+)/i";
    sid:202647844;
    rev:1;
    metadata:cve CVE-2026-47844;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-47844;
    classtype:attempted-information-leak;
)

Elastic Detection

sequence by client_ip with maxspan=5s
  [ http where http.response.status_code == 200 and http.request.method == "GET" ]
  [ http where http.response.status_code == 200 and 
      (http.response.body contains "Exception" or http.response.body contains "at org.springframework") and
      url.original != "/*" ]
  [ http where http.response.headers contains "x-b3-traceid" or http.response.headers contains "X-B3-SpanId" ]

Splunk SPL Query

index=web earliest=-15m
| search "Server"="ReactorNetty*" OR sourcetype="access_combined" 
| where like(response, "%Exception%") OR like(_raw, "%reactor.netty%")
| stats count by src_ip, uri_path, status
| where count > 10

Wazuh OSSEC Rule

<rule id="100478" level="10">
  <decoded_as>json</decoded_as>
  <field name="server">ReactorNetty</field>
  <match>Exception</match>
  <description>Reactor Netty information leak - exception details in HTTP response (CVE-2026-47844)</description>
  <group>web_application_attack,vulnerability,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source, no vendor advisory, and no fixed version has been announced. Reactor Netty upstream has not acknowledged the vulnerability in a public advisory as of the reporting date.

1) Immediate Mitigations:

• Disable Brave Tracing on Reactor Netty HTTP server instances if distributed tracing is not critical to production observability. This removes the vulnerable code path entirely.
• If Brave Tracing must remain enabled, restrict access to the HTTP server using network segmentation or an application firewall to limit who can send arbitrary requests (though CVSS scores this as no-auth required, restricting network access reduces exposure).
• Configure global exception handlers (e.g., Spring @ControllerAdvice with ResponseEntityExceptionHandler) to return generic error messages to clients, stripping stack traces and internal exception class names before they reach the HTTP response layer.

2) Patch/Upgrade Steps:

• Monitor the Reactor Netty GitHub repository (https://github.com/reactor/reactor-netty) and the official release notes for a patched version. When available, upgrade to Reactor Netty 1.3.7 or later (or the equivalent patched version in the 1.1.x / 1.0.x branches).
• Subscribe to the Spring Security and Spring Framework mailing lists for advisory notifications, as Reactor Netty is the default server for Spring WebFlux.

3) Long-Term Hardening:

• Enable runtime tracing security: when using Brave Tracing, ensure that span/exception details are sanitized before being propagated to transport headers or response bodies.
• Implement strict egress filtering and logging of all HTTP responses to detect anomalous exception data in outbound traffic.
• Adopt a "fail-closed" error-handling policy: never expose raw exception messages to clients in production, regardless of framework defaults.
• Conduct a security audit of all Reactor Netty deployments in your environment to identify instances with Brave Tracing enabled (e.g., scan configurations for brave dependencies or tracing properties).
• Integrate the detection rules above into your SIEM/IDS stack to monitor for signs of attempted exploitation once a PoC becomes publicly available.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47844
2. Reactor Netty Official Repository (for patch monitoring): https://github.com/reactor/reactor-netty
3. Brave Tracing Documentation: https://github.com/openzipkin/brave
4. CISA Known Exploited Vulnerabilities Catalog (CVE not listed, verified): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. CWE-209 (Generation of Error Message Containing Sensitive Information) reference: https://cwe.mitre.org/data/definitions/209.html

Threat Actor Activity / Exploit-in-the-Wild Evidence: None. No active exploitation campaigns, public PoC, exploit code, or Nuclei templates are known at the time of writing. The EPSS score has not yet been assigned by FIRST.org. Given the absence of a patch, this vulnerability should be treated as a high-priority monitoring target for your enterprise threat hunting teams.