CVE-2026-47843 Reactor Netty may incorrectly route traffic due to DNS resolver reuse
Reactor Netty may reuse DNS resolvers across clients, potentially allowing traffic routing to unintended hosts in multi-client scenarios.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47843?
CVE-2026-47843 is a low-severity server-side request forgery vulnerability in Spring Reactor Netty, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
Which versions are affected by CVE-2026-47843?
It affects 1 product.
Products include Broadcom Reactor Netty.
How do I fix CVE-2026-47843?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-47843 being exploited?
There is no known exploitation of CVE-2026-47843 in the wild and no public exploit code.
Other vulnerabilities in Spring Reactor Netty
- CVE-2023-34062 In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack
- CVE-2019-11284 Reactor Netty authentication leak in redirects
- CVE-2020-5403 DoS Via Malformed URL with Reactor Netty HTTP Server
- CVE-2020-5404 Authentication Leak On Redirect With Reactor Netty HttpClient
- CVE-2026-47848 Reactor Netty WebSocket Client Leaks Credentials On Redirect
Sources
Also known as CLEANSTART-2026-CL63424, CLEANSTART-2026-FI75370, CLEANSTART-2026-GW15046, CLEANSTART-2026-IJ88105, CLEANSTART-2026-UA66852, GHSA-7f23-wcwg-2f8r.