CVE-2026-47691: Netty has Insufficient Bailiwick Validation for NS Records
Summary Netty's DnsResolveContext insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like .co.uk).
Details In io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName.
This means if the resolver queries evil.co.uk., it will accept an NS record claiming authority over co.uk.. Subsequently, the handleWithAdditional method caches the associated A records from the ADDITIONAL section directly into the authoritativeDnsServerCache under the parent domain's key (co.uk.). This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under co.uk..
The io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#cache method only prevents caching if the record is for the root zone (dots == 1).
Impact DNS Cache Poisoning. Any application using Netty's DNS resolver is impacted.
Other sources
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like .co.uk). In io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the handleWithAdditional method caches the associated A records from the ADDITIONAL section directly into the authoritativeDnsServerCache under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47691?
CVE-2026-47691 has a severity rating of 8.7, which is classified as high.
How does CVE-2026-47691 impact DNS security?
CVE-2026-47691 allows an attacker to poison the DNS cache for parent domains through insufficient validation of NS records.
Which versions of Netty are affected by CVE-2026-47691?
CVE-2026-47691 affects the netty-resolver-dns component in specific versions of the Netty framework.
How can I mitigate the risk of CVE-2026-47691?
To mitigate CVE-2026-47691, you should update to the latest version of Netty where the vulnerability has been addressed.
Who is vulnerable to CVE-2026-47691?
Organizations using vulnerable versions of Netty's dns-resolver-dns that rely on DNS resolutions are at risk from CVE-2026-47691.