CLEANSTART-2026-VT97144: In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver
Security vulnerability affects the elasticsearch package. In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/elasticsearchto a version that resolves this vulnerability.Fixed in 9.2.8-r13
Frequently Asked Questions
Which deployments are most relevant for triage?
Deployments that use multiple clients with different DNS resolver configurations are the relevant scenario. The affected software is cleanstart/elasticsearch.
Does exploitation require authentication or user interaction?
No privileges and no user interaction are indicated by the supplied vector. The attack vector is network-based, but exploitation has high attack complexity.
What security impact is indicated?
The supplied severity is low, with a score of 3.7. The vector indicates low integrity impact and no confidentiality or availability impact.