This vulnerability causes the Reactor Netty HTTP Server to misinterpret the remote IP address when the HAProxy Protocol is enabled. As a result, an attacker can send traffic that appears to originate from a trusted IP, potentially bypassing IP‑based access controls, rate limits, or other server‑side filtering. The weakness reflects improper handling of a trusted source address and is classified under CWE‑640 and CWE‑285.

Spring: Reactor Netty is affected. Versions 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 and earlier contain the flaw. Any deployment using these releases with the HAProxy Protocol enabled is at risk.

The CVSS score of 5.3 indicates a moderate severity. Because the EPSS score is not available, the current exploitation probability is unknown, and the vulnerability is not listed in CISA KEV. The attack requires the application to be configured to use the HAProxy Protocol, and the attacker must be able to send packets that mimic HAProxy framing. Once that condition is met, the attacker can influence the perceived client IP address to gain unauthorized access or evade controls.