CVE-2026-47843

LowCVSS 3.7/10Last modified Sep 4, 2026

Description

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2026
Last modified: Sep 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-478443.7In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the CVE-2026-478455.3In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order f CVE-2026-478469.8Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is config CVE-2026-478475.3Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replicatio CVE-2026-478486.1In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials CVE-2026-478497.1Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/jso CVE-2026-47856.4The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th CVE-2026-478504.3Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immut CVE-2026-478517.5Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spr CVE-2026-478527.5A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spr CVE-2026-478566.3Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that h CVE-2026-478575.9In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (