CVE-2026-47691
CWE-345Published: June 12, 2026· Updated: Jul 15, 2026
Official Description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Risk Analysis
Netty versions prior to 4.1.135.Final and 4.2.15.Final are critically vulnerable to DNS Cache Poisoning due to insufficient validation of NS records' bailiwick in DnsResolveContext. An attacker controlling a subdomain's authoritative name server can poison the cache for parent domains. This flaw, with a CVSS score of 10.0, can lead to severe integrity and confidentiality impacts by redirecting traffic to malicious servers.
No public exploit is currently known for this vulnerability. The attack vector is network-based and has low complexity, making it remotely exploitable.
Upgrade Netty to versions 4.1.135.Final or 4.2.15.Final to patch this DNS cache poisoning vulnerability. Ensure DNS resolvers are configured to strictly validate bailiwick rules.
Technical Analysis
CVE-2026-47691 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 10.0.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (11)
Quick Facts
Related CVEs (CWE-345)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-47691 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts