PatchTheCVEreactor netty vulnerabilities and fixes
Recent CVEs affecting reactor netty, with upgrade or downgrade steps. 5 tracked.
Also searched as: reactornetty.
reactor netty has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-08-27. Highest priority: CVE-2026-47874 (score 32/100).
- CVE-2026-47843 LOW 3.7 UPGRADE In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may
- CVE-2026-47844 MEDIUM 5.3 UPGRADE In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests
- CVE-2026-47848 MEDIUM 6.1 UPGRADE In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSock
- CVE-2026-47845 MEDIUM 5.3 UPGRADE In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy P
- CVE-2026-47874 MEDIUM 5.3 UPGRADE The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the
FAQ
How do I fix reactor netty vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is reactor netty being exploited right now?
None of the tracked reactor netty CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which reactor netty CVE should I patch first?
CVE-2026-47874 currently ranks highest (32/100): The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the.