CVE-2026-47845: CWE-290 Authentication Bypass by Spoofing in Spring Reactor Netty

This vulnerability (CVE-2026-47845) involves an authentication bypass by spoofing in Spring Reactor Netty HTTP Server when HAProxy Protocol is enabled. The server may incorrectly determine the remote IP address, which could lead to bypassing authentication checks that rely on IP-based validation. Affected versions include Reactor Netty 1.0.52 and earlier, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

The impact is limited to scenarios where the application uses Reactor Netty HTTP Server with HAProxy Protocol enabled and relies on remote IP address for authentication or access control. An attacker could spoof the remote IP address, potentially bypassing authentication mechanisms that trust the IP address. No confidentiality or availability impacts are indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should carefully evaluate their use of HAProxy Protocol with Reactor Netty and consider additional authentication controls that do not rely solely on remote IP address validation.