CVE-2026-47843: Reactor Netty may incorrectly route traffic due to DNS resolver reuse
In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
reactor-nettyto a version that resolves this vulnerability.Fixed in 1.0.52 - Upgrade
Upgrade
reactor-nettyto a version that resolves this vulnerability.Fixed in 1.1.0 - Upgrade
Upgrade
reactor-nettyto a version that resolves this vulnerability.Fixed in 1.2.18 - Upgrade
Upgrade
reactor-nettyto a version that resolves this vulnerability.Fixed in 1.3.0 - Upgrade
Upgrade
reactor-nettyto a version that resolves this vulnerability.Fixed in 1.3.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Reactor Netty are affected only in scenarios where multiple clients use different DNS resolver configurations. The listed affected versions are 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 and earlier.
What must an attacker be able to do to exploit this?
The supplied data rates exploitation as network-accessible, requiring no privileges or user interaction, but with high attack complexity. The issue can result in incorrect traffic routing through reuse of a previously configured DNS resolver.
Is a default configuration known to be affected?
The provided information does not identify a default configuration as affected. It specifically describes exposure when multiple clients have different DNS resolver configurations.