{"id":"CVE-2026-47843","aliases":["CLSA-2026-1791529633","CLSA-2026-1791547948","CLSA-2026-1791989666","CLSA-2026-1792505040","CLSA-2026-1793116571","CLSA-2026-1793345120","EUVD-2026-66678","GHSA-7f23-wcwg-2f8r"],"status":"published","title":"Reactor Netty may incorrectly route traffic due to DNS resolver reuse","description":"In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00256,"percentile":0.17257,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-08-26T19:22:24Z","modified":"2026-11-02T19:46:31Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.4"}]}],"versions":["1.1.31","1.1.31-tuxcare.1","1.1.31-tuxcare.2","1.1.31-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.5"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2","1.0.48-tuxcare.3","1.0.48-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.18"},{"fixed":"1.2.18-tuxcare.2"}]}],"versions":["1.2.18","1.2.18-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.32"},{"fixed":"1.0.32-tuxcare.6"}]}],"versions":["1.0.32","1.0.32-tuxcare.1","1.0.32-tuxcare.2","1.0.32-tuxcare.3","1.0.32-tuxcare.4","1.0.32-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http-brave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.34"},{"fixed":"1.0.34-tuxcare.1"}]}],"versions":["1.0.34"],"bundled":8}],"products":[{"vendor":"broadcom","product":"reactor_netty"},{"vendor":"spring","product":"reactor netty"},{"vendor":"vmware","product":"reactor netty"}],"references":[{"url":"https://spring.io/security/cve-2026-47843","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47843"},{"url":"https://github.com/advisories/GHSA-7f23-wcwg-2f8r"}],"sources":{"cve":[{"id":"CVE-2026-47843","title":"Reactor Netty may incorrectly route traffic due to DNS resolver reuse","description":"In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T19:22:24.697Z","modified":"2026-08-26T19:45:10.489Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-66678","description":"In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T19:22:24Z","modified":"2026-08-26T19:45:10Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:01:29.296861Z"}],"ghsa":[{"id":"GHSA-7f23-wcwg-2f8r","title":"In specific scenarios involving multiple clients with different DNS resolver configurations,...","description":"In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T21:31:43Z","modified":"2026-08-26T21:31:52Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:11:01.362113Z"}],"nvd":[{"id":"CVE-2026-47843","description":"In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier","status":"published","published":"2026-08-26T20:17:26.193Z","modified":"2026-09-04T19:11:22.78Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CLSA-2026-1791529633","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.1.31-tuxcare.4.","status":"published","published":"2026-10-09T07:07:13Z","modified":"2026-11-02T19:46:27.100145141Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791547948","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.48-tuxcare.5.","status":"published","published":"2026-10-09T12:12:28Z","modified":"2026-11-02T19:46:26.379358987Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791989666","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.2.18-tuxcare.2.","status":"published","published":"2026-10-14T14:54:26Z","modified":"2026-11-02T19:46:27.828680262Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792505040","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.32-tuxcare.6.","status":"published","published":"2026-10-20T14:04:00Z","modified":"2026-11-02T19:46:29.903938891Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793116571","title":"TuxCare security update for io.projectreactor.netty (5 CVEs)","description":"TuxCare rebuilt 3 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.1.15-tuxcare.3.","status":"published","published":"2026-10-27T15:56:11Z","modified":"2026-11-02T19:46:31.80652923Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793345120","title":"TuxCare security update for io.projectreactor.netty (8 CVEs)","description":"TuxCare rebuilt 4 io.projectreactor.netty packages to address 8 CVEs. Fixed in 1.0.34-tuxcare.1.","status":"published","published":"2026-10-30T08:25:21Z","modified":"2026-10-30T13:30:08.72554284Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}