Executive brief
Netty is a popular framework used by developers to build high-performance network applications and servers. A security flaw in its DNS component allows an attacker to 'poison' the application's DNS cache, redirecting network traffic intended for legitimate domains to malicious servers. This could lead to the theft of sensitive customer data or the interception of secure communications without the application's knowledge.
Technical details
A DNS cache poisoning vulnerability exists in Netty's `DnsResolveContext` due to insufficient bailiwick validation of NS records. The `AuthoritativeNameServerList#add` method incorrectly accepts NS records from the AUTHORITY section if the record's name is a suffix of the `questionName`, allowing a subdomain's name server to claim authority over a parent domain (e.g., a server for 'sub.example.com' claiming authority for 'example.com'). The `handleWithAdditional` method then caches associated A records from the ADDITIONAL section into the `authoritativeDnsServerCache` under the parent domain's key. This allows a remote attacker who controls a malicious authoritative name server to redirect future traffic for the parent domain. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.
Affected products
- Netty netty-resolver-dns <= 4.1.134.Final, >= 4.2.0.Final, <= 4.2.14.Final
Timeline
- 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
- 2026-06-05: advisory: GitHub Security Advisory GHSA-5pvg-856g-cp85 published
- 2026-06-12: disclosed: NVD publication of CVE-2026-47691