CVE-2026-47843 in Reactor Netty
Summary
by MITRE • 08/26/2026
In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in Reactor Netty versions ranging from 1.0.52 through 1.3.6, as well as the older 1.1.0 to 1.2.18 series, represents a significant flaw in how DNS resolution resources are managed within multi-tenant or complex network environments. This issue stems from an improper state management mechanism where the library fails to correctly isolate DNS resolver instances across different client contexts. In high-concurrency applications that utilize Reactor Netty for non-blocking HTTP communication, it is common practice to configure distinct DNS resolvers based on specific routing rules, tenant isolation requirements, or network segmentation policies. However, due to this defect, a previously configured DNS resolver may be incorrectly reused by subsequent clients that were intended to use different resolution configurations. This behavior violates the principle of least privilege and proper resource encapsulation, leading to unpredictable name resolution outcomes where requests are directed based on stale or mismatched resolver settings rather than the current client's explicit configuration.
From a technical perspective, this flaw can be classified under CWE-672, which pertains to the use of operation-specific variables without proper synchronization or isolation, although it specifically manifests as an improper resource management error akin to CWE-401 on missing release of memory after effective usage if we consider the lifecycle of resolver objects. The root cause lies in the internal caching strategy employed by Reactor Netty for DNS resolution components. When multiple clients are instantiated with varying DNS configurations, the library incorrectly assumes that a cached resolver instance is universally applicable or fails to invalidate previous instances when new distinct configurations are introduced. This leads to a state leakage scenario where one client's network path influences another unrelated client's connectivity. In environments utilizing ATT&CK technique T1071 Application Layer Protocol for communication, this misconfiguration can cause traffic to be routed through unintended DNS servers, potentially exposing sensitive query data or causing denial of service conditions if the reused resolver is unreachable or restricted by firewall rules not applicable to the current tenant.
The operational impact of this vulnerability varies depending on the deployment architecture but generally results in connectivity failures and security policy violations. Clients may experience intermittent connection timeouts because they are attempting to resolve hostnames using a DNS server that does not have visibility into their specific domain namespace. In multi-tenant SaaS applications, this can lead to data leakage or cross-tenant access if one tenant's resolver is configured with internal corporate domains while another uses public resolvers, causing the latter to inadvertently query private infrastructure via an incorrect path. Furthermore, attackers who control a DNS server in the reused configuration could perform man-in-the-middle attacks by returning malicious IP addresses for legitimate services, effectively compromising the integrity of communications for all clients sharing that misconfigured resolver instance. This undermines trust in the application's ability to securely resolve external dependencies and can lead to significant downtime or unauthorized access depending on the criticality of the affected services.
Mitigation strategies must prioritize immediate version upgrades as well as architectural adjustments if upgrading is not immediately feasible. The most effective remediation is to upgrade Reactor Netty to a patched version that corrects the DNS resolver caching logic, ensuring strict isolation between client configurations. For organizations unable to patch immediately, implementing explicit disposal of previous DNS resolver instances before configuring new ones can help mitigate state leakage. Additionally, developers should review their application's initialization sequences to ensure that shared resources are not inadvertently reused across disparate contexts. It is also advisable to implement robust monitoring and logging around DNS resolution failures to detect anomalies indicative of this misconfiguration in production environments. Regular security audits focusing on resource lifecycle management within reactive libraries will help prevent similar issues from arising in future development cycles, ensuring compliance with secure coding standards that mandate proper isolation of shared stateful components.