CVE-2026-47843

Received Received - Intake

DNS Resolver Misconfiguration in Reactor Netty

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VMware

Description

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-47843

Affected Vendors & Products

Vendor	Product	Version / Range
reactor_netty	reactor_netty	From 1.1.0 (inc) to 1.3.6 (inc)
reactor_netty	reactor_netty	to 1.1.0 (exc)
reactor_netty	reactor_netty	1.0.52

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability occurs when Reactor Netty incorrectly reuses a DNS resolver configured for one client in a scenario with multiple clients using different DNS resolver settings. This can lead to DNS resolution issues affecting network communication.

Detection Guidance

This vulnerability involves incorrect reuse of DNS resolvers in Reactor Netty. To detect it, check your Reactor Netty version against the affected ranges (1.0.52 and earlier, 1.1.0-1.2.18, 1.3.0-1.3.6). Use commands like 'find / -name "reactor-netty*.jar" 2>/dev/null' to locate the library and 'java -jar your-app.jar --version' to check version details.

Impact Analysis

The impact includes potential network communication failures or misrouting due to incorrect DNS resolution. This may cause service disruptions or unexpected behavior in applications relying on Reactor Netty for networking.

Compliance Impact

The vulnerability involves incorrect reuse of DNS resolvers in Reactor Netty, which could lead to improper handling of network requests. This may cause unintended data exposure or misrouting, potentially violating data integrity or confidentiality requirements in standards like GDPR or HIPAA.

Mitigation Strategies

Upgrade Reactor Netty to a version outside the affected ranges (1.3.7+, 1.2.19+, or 1.0.53+). If upgrading is not possible, review DNS resolver configurations for inconsistencies across clients to prevent incorrect reuse.

Hi! I’m here to help you understand CVE-2026-47843. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70