CVE-2026-47843

CVE-2026-47843

Low · published August 27, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.

Reactor Netty 1.3.0 - 1.3.6

Reactor Netty 1.1.0 - 1.2.18

Reactor Netty 1.0.52 and earlier

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00256 · 16.2th percentile
Published
2026-08-27T00:17Z
Affected products (3)
ProductVersionsFixed in
broadcom/reactor_netty< 1.0.531.0.53
broadcom/reactor_netty≥ 1.1.0, < 1.2.191.2.19
broadcom/reactor_netty≥ 1.3.0, < 1.3.6.11.3.6.1
References (1)
https://spring.io/security/cve-2026-47843 · [email protected]
EPSS history
Timeline
  • 28 AUG 06:43Z
    EPSS moved — → 0%
    epss
  • 26 AUG 19:22Z
    Reactor Netty may incorrectly route traffic due to DNS resolver reuse
    cvelistv5