Loading vulnerability…
DNS cache poisoning in Netty through insufficient NS-record bailiwick validation
CVE-2026-47691 is a DNS cache-poisoning vulnerability in Netty's DNS resolver, affecting the 4.1 branch before 4.1.135.Final and the 4.2 branch before 4.2.15.Final. The DnsResolveContext.AuthoritativeNameServerList#add method accepts NS records from a DNS response's AUTHORITY section when the record name is a suffix of questionName, without adequately validating whether the responding server is authoritative for that domain. The handleWithAdditional method subsequently caches associated A records from the ADDITIONAL section in authoritativeDnsServerCache under the parent domain's key. An attacker controlling a subdomain's authoritative name server can consequently inject authoritative-server mappings for a parent domain, influencing subsequent resolutions beneath that parent.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Poisoned authoritative-server cache entries can redirect subsequent DNS queries for domains beneath the affected parent to attacker-controlled name servers, extending the impact beyond the attacker's own subdomain. Applications relying on the resulting DNS answers may connect to attacker-selected destinations, potentially exposing sensitive information or accepting manipulated data, subject to independent transport and application authentication controls. The vulnerability-specific CVSS vector identifies high confidentiality and integrity impact across a changed security scope, with no availability impact.
If you can’t patch tonight, do this now.
Until patched, avoid resolving untrusted domains with Netty's vulnerable DNS resolver. Where supported, replace its resolution path with a trusted external resolver rather than merely forwarding queries through another server while retaining the vulnerable response processing. Monitor DNS responses and resolver caches for unexpected parent-domain authoritative-server mappings supplied by subdomain name servers. These measures do not replace upgrading.
Patch, then assume compromise.
Upgrade io.netty:netty-resolver-dns to 4.1.135.Final or later in the 4.1 branch, or 4.2.15.Final or later in the 4.2 branch. Update applications and bundled dependencies so the corrected resolver is actually loaded at runtime. For Ubuntu 24.04 LTS, upgrade libnetty-java to 1:4.1.48-9ubuntu0.2+esm2 or a superseding security-fixed package; this fix is available through Ubuntu Pro ESM Apps. Red Hat JBoss EAP 7.4 ELS deployments can apply the EAP 7.4.25 update, which includes Netty 4.1.135.Final-redhat-00001. For other products embedding Netty, install the vendor release explicitly addressing this CVE.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.