PT-2026-47614 · Netty · Netty

Published 2026-06-08 · Updated 2026-06-09 · CVE-2026-47691

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Netty (ionetty:netty-resolver-dns) (affected versions not specified)

Description Insufficient validation of the bailiwick of NS records in DnsResolveContext allows for DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains. Specifically, the add() function in io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList accepts any NS record from the AUTHORITY section if the record's name is a suffix of the questionName. Consequently, the handleWithAdditional() function caches associated A records from the ADDITIONAL section into the authoritativeDnsServerCache under the parent domain's key, bypassing bailiwick rules—which dictate that a server authoritative for a subdomain should not be trusted for its parent. The cache() function in io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList only prevents caching for the root zone.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-47691

GHSA-5PVG-856G-CP85

Affected Products

Netty

References · 6

• https://osv.dev/vulnerability/GHSA-5pvg-856g-cp85 · Vendor Advisory
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85 · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final · Note
• https://twitter.com/dailycve/status/2064151192419127367 · Twitter Post