CVE-2026-47843 - Vulnerability Details - OpenCVE

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Spring	Reactor Netty

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Spring	Reactor Netty

References

Link	Providers
https://spring.io/security/cve-2026-47843

History

Wed, 26 Aug 2026 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Spring Spring reactor Netty
Weaknesses		CWE-665
Vendors & Products		Spring Spring reactor Netty

Wed, 26 Aug 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 26 Aug 2026 19:30:00 +0000

Type	Values Removed	Values Added
Description		In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
Title		Reactor Netty may incorrectly route traffic due to DNS resolver reuse
References		https://spring.io/security/cve-2026-47843
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2026-08-26T19:22:24.697Z

Updated: 2026-08-26T19:45:10.489Z

Reserved: 2026-05-20T10:00:51.004Z

Link: CVE-2026-47843

Vulnrichment

Updated: 2026-08-26T19:45:03.237Z

NVD

Status : Received

Published: 2026-08-26T20:17:26.193

Modified: 2026-08-26T20:17:26.193

Link: CVE-2026-47843

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-26T20:45:03Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47843", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-05-20T10:00:51.004Z", "datePublished": "2026-08-26T19:22:24.697Z", "dateUpdated": "2026-08-26T19:45:10.489Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-26T19:22:24.697Z"}, "title": "Reactor Netty may incorrectly route traffic due to DNS resolver reuse", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-706 Use of Incorrectly-Resolved Name or Reference", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver."}]}], "affected": [{"vendor": "Spring", "product": "Reactor Netty", "versions": [{"status": "affected", "version": "1.3.0", "lessThanOrEqual": "1.3.6", "versionType": "custom"}, {"status": "affected", "version": "1.1.0", "lessThanOrEqual": "1.2.18", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThanOrEqual": "1.0.52", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.</p><p>Reactor Netty 1.3.0 - 1.3.6<br/>Reactor Netty 1.1.0 - 1.2.18<br/>Reactor Netty 1.0.52 and earlier</p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-47843"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.7, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T19:31:55.895962Z", "id": "CVE-2026-47843", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T19:45:10.489Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47843", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T19:31:55.895962Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T19:45:03.237Z"}}], "cna": {"title": "Reactor Netty may incorrectly route traffic due to DNS resolver reuse", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Reactor Netty", "versions": [{"status": "affected", "version": "1.3.0", "versionType": "custom", "lessThanOrEqual": "1.3.6"}, {"status": "affected", "version": "1.1.0", "versionType": "custom", "lessThanOrEqual": "1.2.18"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.52"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-47843"}], "descriptions": [{"lang": "en", "value": "In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier", "supportingMedia": [{"type": "text/html", "value": "<p>In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.</p><p>Reactor Netty 1.3.0 - 1.3.6<br/>Reactor Netty 1.1.0 - 1.2.18<br/>Reactor Netty 1.0.52 and earlier</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-706 Use of Incorrectly-Resolved Name or Reference"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-26T19:22:24.697Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47843", "state": "PUBLISHED", "dateUpdated": "2026-08-26T19:45:10.489Z", "dateReserved": "2026-05-20T10:00:51.004Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-08-26T19:22:24.697Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}