This vulnerability causes the Reactor Netty HTTP Server to misinterpret the remote IP address when it is configured to use the HAProxy Protocol. As a result, an attacker can send traffic that appears to originate from a trusted IP, potentially bypassing IP‑based access controls, rate limits, or other server‑side filtering. The weakness reflects improper handling of a trusted source address and is classified under CWE‑290. Based on the description, it is inferred that the attacker must craft packets that include correct HAProxy protocol frames to manipulate the server's perceived client address.

Spring: Reactor Netty is affected. Versions 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 and earlier contain the flaw. Any deployment using these releases with the HAProxy Protocol enabled is at risk.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is below 1%, translating to an exploitation probability of approximately 0.18%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be able to send packets that mimic HAProxy framing. Once that condition is met, the attacker can influence the perceived client IP address to gain unauthorized access or evade controls.