CVE-2026-47843— Reactor Netty may incorrectly route traffic due to DNS resolver reuse
Quick assessment
Affected
Spring Reactor Netty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在涉及多个客户端且其 DNS 解析器配置不同的特定场景中，Reactor Netty 可能会错误地复用之前已配置的 DNS 解析器。 受影响版本： Reactor Netty 1.3.0 – 1.3.6 Reactor Netty 1.1.0 – 1.2.18 Reactor Netty 1.0.52 及更早版本
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Spring | Reactor Netty | 1.3.0≤ 1.3.6 |
affected |
1.1.0≤ 1.2.18 |
affected | ||
≤ 1.0.52 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47843
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Reactor Netty may incorrectly route traffic due to DNS resolver reuse
Source: CVE Program / CVE List V5
Vulnerability Description
In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.
Reactor Netty 1.3.0 - 1.3.6
Reactor Netty 1.1.0 - 1.2.18
Reactor Netty 1.0.52 and earlier
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Reactor Netty | 1.3.0 ~ 1.3.6 | - |
|
II. Public POCs for CVE-2026-47843
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47843
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47843 (1)
Same Patch Batch · Spring · 2026-08-26 · 20 CVEs total
| CVE-2026-47852 | 7.5 HIGH | Predictable cache directory location allows local ONNX model substitution in Spring AI |
| CVE-2026-47851 | 7.5 HIGH | Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Re |
| CVE-2026-47841 | 7.4 HIGH | WebAuthn User Verification Bypass via Session Serialization |
| CVE-2026-47836 | 7.2 HIGH | Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN |
| CVE-2026-47837 | 6.8 MEDIUM | Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests |
| CVE-2026-47842 | 6.5 MEDIUM | Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Co |
| CVE-2026-47860 | 6.5 MEDIUM | Unbounded decompression of attacker-supplied compressed message bodies |
| CVE-2026-47861 | 6.3 MEDIUM | UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when ac |
| CVE-2026-47856 | 6.3 MEDIUM | JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class w |
| CVE-2026-47848 | 6.1 MEDIUM | Reactor Netty WebSocket Client Leaks Credentials On Redirect |
| CVE-2026-47863 | 5.9 MEDIUM | Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream deli |
| CVE-2026-47857 | 5.9 MEDIUM | Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around |
| CVE-2026-47862 | 5.4 MEDIUM | ZipTransformer uses file_name header to build workDirectory path without sanitization |
| CVE-2026-47859 | 5.4 MEDIUM | Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote |
| CVE-2026-47844 | 5.3 MEDIUM | Reactor Netty HTTP Server Leaks Exception Details |
| CVE-2026-47845 | 5.3 MEDIUM | Reactor Netty HTTP Server may incorrectly evaluate proxy addresses |
| CVE-2026-47874 | 5.3 MEDIUM | Reactor Netty HTTP Server Denial of Service With Pipelined Requests |
| CVE-2026-47834 | 4.8 MEDIUM | Spring Data JPA Sort expression validation bypass |
| CVE-2026-47850 | 4.3 MEDIUM | Spring Data REST allows mutation of the version property of immutable aggregates via PUT |
IV. Related Vulnerabilities
Same product: Reactor Netty
-
CVE-2026-47874
Reactor Netty HTTP Server Denial of Service With Pipelined R -
CVE-2026-47845
Reactor Netty HTTP Server may incorrectly evaluate proxy add -
CVE-2026-47848
Reactor Netty WebSocket Client Leaks Credentials On Redirect -
CVE-2026-47844
Reactor Netty HTTP Server Leaks Exception Details -
CVE-2026-41715
Reactor Netty HTTP Client Leaks Credentials On Protocol Down
Same vendor: Spring
-
CVE-2026-47893
Spring Framework Request Headers Included in Exception Reaso -
CVE-2026-47892
Spring Framework Header Predicate Bypass in WebFlux Function -
CVE-2026-47891
Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder -
CVE-2026-47890
Spring Framework Server Sent Event stream corruption while r -
CVE-2026-47889
Spring Framework sameSite Attribute Dropped in JettyCoreServ
V. Comments for CVE-2026-47843
No comments yet