CVE-2026-47691: Netty DNS cache poisoning via insufficient NS record bailiwick validation

CVE-2026-47691 · Severity: high · CVSS 8.7 · Published 2026-06-12

Netty is a popular framework used by developers to build high-performance network applications and servers. A security flaw in its DNS component allows an attacker to 'poison' the application's DNS cache, redirecting network traffic intended for legitimate domains to malicious servers. This could lead to the theft of sensitive customer data or the interception of secure communications without the application's knowledge.

Technologies: io.netty:netty-resolver-dns (Maven), Netty-Resolver-Dns, Netty Project Resolver DNS. Vendors: Maven, Netty, Netty Project.

Quick answers

Is CVE-2026-47691 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47691 being exploited in the wild.
How severe is CVE-2026-47691?
High severity, with a CVSS score of 8.7, published 12 June 2026.
Which products and versions are affected?
io.netty:netty-resolver-dns (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final; Netty-Resolver-Dns >= 4.2.0.Final, <= 4.2.14.Final; Netty Project Resolver DNS <= 4.1.134.Final, >= 4.2.0.Final, <= 4.2.14.Final.
Is there a fix for CVE-2026-47691?
Yes. io.netty:netty-resolver-dns (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47691 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47691?
Check whether you run io.netty:netty-resolver-dns (Maven), Netty-Resolver-Dns or Netty Project Resolver DNS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-resolver-dns (Maven): upgrade to 4.2.15.Final or later
    # set io.netty:netty-resolver-dns to 4.2.15.Final in your pom.xml or build.gradle

Technical details

A DNS cache poisoning vulnerability exists in Netty's `DnsResolveContext` due to insufficient bailiwick validation of NS records. The `AuthoritativeNameServerList#add` method incorrectly accepts NS records from the AUTHORITY section if the record's name is a suffix of the `questionName`, allowing a subdomain's name server to claim authority over a parent domain (e.g., a server for 'sub.example.com' claiming authority for 'example.com'). The `handleWithAdditional` method then caches associated A records from the ADDITIONAL section into the `authoritativeDnsServerCache` under the parent domain's key. This allows a remote attacker who controls a malicious authoritative name server to redirect future traffic for the parent domain. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.

Affected products

  • Netty netty-resolver-dns <= 4.1.134.Final, >= 4.2.0.Final, <= 4.2.14.Final

Identifiers

  • CVE-2026-47691
  • GHSA-5pvg-856g-cp85

Timeline

  • 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
  • 2026-06-05: advisory: GitHub Security Advisory GHSA-5pvg-856g-cp85 published
  • 2026-06-12: disclosed: NVD publication of CVE-2026-47691

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.