Executive brief
Reactor Netty is a networking library used in Java applications to handle network communication. Under specific scenarios where multiple clients use different DNS configurations, the library may incorrectly reuse a previously configured DNS resolver, potentially allowing DNS queries to be resolved incorrectly or through an unintended resolver.
Technical details
This vulnerability occurs in Reactor Netty's DNS resolver management logic, where the resolver state is not properly isolated between clients with different configurations. The affected versions (1.0.52 and earlier, 1.1.0–1.2.18, and 1.3.0–1.3.6) fail to correctly handle DNS resolver instantiation when multiple clients are initialized with different resolver settings. An attacker with network access could potentially intercept or manipulate DNS resolution in applications using vulnerable versions. The fix is available in patched versions beyond those listed as vulnerable.
Affected products
- VMware Reactor Netty 1.0.52 and earlier, 1.1.0–1.2.18, 1.3.0–1.3.6
Timeline
- 2026-08-26: disclosed