CVE-2026-47843 Security Details

CVE ID

CVE-2026-47843

CWE

NVD-CWE-noinfo

CVE Description

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

Published

Aug 21, 2026

CVSS Score & Severity

6.3Medium

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.256%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

reactor/netty/transport/NameResolverProvider.equals(Ljava/lang/Object;)Z

JVM

reactor/netty/transport/NameResolverProvider.hashCode()I

JVM

reactor/netty/transport/NameResolverProvider.newNameResolverGroup(Lreactor/netty/resources/LoopResources;Z)Lio/netty/resolver/dns/DnsAddressResolverGroup;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT