CVE-2026-47843: Reactor Netty DNS Resolver Vulnerability

CVE-2026-47843 Overview

CVE-2026-47843 affects Reactor Netty, a reactive networking library used by Spring-based applications for non-blocking HTTP, TCP, and UDP clients. In specific scenarios involving multiple clients configured with different Domain Name System (DNS) resolvers, Reactor Netty may reuse a previously configured resolver instead of the one requested by the current client. This behavior can cause name resolution to occur through an unintended resolver, undermining the integrity of DNS lookups in multi-tenant or segmented environments.

Critical Impact
Applications relying on per-client DNS resolver isolation may perform lookups through an unintended resolver, weakening resolution boundaries between clients.

Affected Products

Reactor Netty 1.3.0 through 1.3.6
Reactor Netty 1.1.0 through 1.2.18
Reactor Netty 1.0.52 and earlier

Discovery Timeline

2026-08-26 - CVE-2026-47843 published to National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-47843

Vulnerability Analysis

Reactor Netty provides configurable DNS resolvers per client instance so that applications can direct lookups to specific resolvers, such as internal-only resolvers, public resolvers, or resolvers with different security policies. Under specific conditions when multiple clients are instantiated with distinct resolver configurations, the library reuses a previously created resolver instead of building one aligned with the current client's configuration.

The result is a mismatch between the requested resolver configuration and the resolver that actually processes the query. Applications enforcing DNS-level segmentation or using resolver selection as part of trust boundaries lose that guarantee. The issue is limited to integrity of resolution and does not enable code execution, data exfiltration, or denial of service.

Root Cause

The root cause is improper caching or reuse logic in the DNS resolver management path within Reactor Netty. When resolver configurations differ across clients, the library fails to differentiate them and returns a resolver that was previously created for another configuration. This is a configuration and design flaw affecting DNS handling ([DNS Vulnerability]).

Attack Vector

Exploitation requires a network-adjacent scenario where an attacker can influence which resolver an application client uses or take advantage of the confusion between resolver instances. The attack complexity is high because the flaw only manifests in specific multi-client configurations. No authentication or user interaction is required, but the practical impact is limited to low integrity effects on DNS responses observed by the application. Refer to the Spring Security Advisory CVE-2026-47843 for technical details.

Detection Methods for CVE-2026-47843

Indicators of Compromise

Unexpected DNS queries originating from application hosts directed at resolvers that should not be used by a given client.
Application logs showing name resolutions succeeding against hosts that should be isolated from a client's configured resolver.
Discrepancies between configured resolver endpoints and observed DNS traffic on the network egress path.

Detection Strategies

Inventory applications using Reactor Netty and compare in-use versions against the vulnerable ranges: 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.
Instrument Reactor Netty clients to log the resolver instance actually bound at request time and alert on divergence from the intended configuration.
Correlate outbound DNS traffic captured at network sensors with the resolver each application client is expected to use.

Monitoring Recommendations

Continuously monitor DNS egress by source process and destination resolver to detect drift from expected resolver-per-client mappings.
Track Reactor Netty dependency versions across build pipelines and container images to catch regressions to vulnerable versions.
Review application startup and reconfiguration events for cases where multiple HttpClient or TcpClient instances are created with different resolver settings.

How to Mitigate CVE-2026-47843

Immediate Actions Required

Upgrade Reactor Netty to a fixed release above 1.3.6 in the 1.3.x line, above 1.2.18 in the 1.1.x/1.2.x line, or above 1.0.52 in the 1.0.x line, per the vendor advisory.
Audit code paths that create multiple Reactor Netty clients with distinct DNS resolver configurations and confirm which resolver each client uses at runtime.
Restrict outbound DNS at the network layer so application hosts can only reach approved resolvers, reducing the impact of resolver confusion.

Patch Information

Refer to the Spring Security Advisory CVE-2026-47843 for fixed version details and remediation guidance from the maintainers. Update reactor-netty-core and reactor-netty-http dependencies in Maven or Gradle build files, then rebuild and redeploy affected services.

Workarounds

Consolidate applications to a single DNS resolver configuration where per-client resolver isolation is not a strict requirement.
Enforce resolver selection at the network layer using firewall rules or egress policies rather than relying solely on client-side configuration.
Where feasible, instantiate Reactor Netty clients in isolated JVM processes so resolver reuse cannot cross client boundaries.

bash

# Configuration example: update Reactor Netty in Maven
mvn versions:use-dep-version -Dincludes=io.projectreactor.netty:reactor-netty-http -DdepVersion=<fixed-version> -DforceVersion=true
mvn versions:use-dep-version -Dincludes=io.projectreactor.netty:reactor-netty-core -DdepVersion=<fixed-version> -DforceVersion=true
mvn clean verify