In specific scenarios, the Reactor Netty HTTP Server can leak exception details across unrelated requests when the server is configured with Brave Tracing. The exposure presents sensitive stack traces and error messages, potentially revealing internal application logic and aiding a malicious actor in crafting further attacks. This vulnerability is an information disclosure weakness and would allow an attacker to gain unprivileged visibility into server internals.

Spring’s Reactor Netty product is impacted. Versions 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 or earlier are listed as vulnerable. The flaw is triggered only when Brave Tracing is enabled, so any deployment using these releases with the tracing component may be at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of < 1% suggests a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in CISA KEV, meaning no known active exploitation campaigns are documented. Exploitation requires network access to the HTTP server and the presence of Brave Tracing; thus the attacker must be able to send crafted requests to the vulnerable instance. While the impact is limited to information disclosure, the existence of this flaw can assist other attacks by leaking internal details.