GHSA-5pvg-856g-cp85

    Dashboard / Vulnerabilities / GHSA-5pvg-856g-cp85

    GHSA-5pvg-856g-cp85

    Published: 8 Jun 2026Last Modified: 18 Sept 2026

    Summary: Netty has Insufficient Bailiwick Validation for NS Records

    Details: ### Summary Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). ### Details In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. This means if the resolver queries evil.co.uk., it will accept an NS record claiming authority over co.uk.. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key (co.uk.). This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under co.uk.. The `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#cache` method only prevents caching if the record is for the root zone (dots == 1). ### Impact DNS Cache Poisoning. Any application using Netty's DNS resolver is impacted.

    References: https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85, https://nvd.nist.gov/vuln/detail/CVE-2026-47691, https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47691.json, https://github.com/netty/netty/releases/tag/netty-4.2.15.Final, https://github.com/netty/netty/releases/tag/netty-4.1.135.Final, https://github.com/netty/netty, https://bugzilla.redhat.com/show_bug.cgi?id=2488439, https://access.redhat.com/security/cve/CVE-2026-47691, https://access.redhat.com/errata/RHSA-2026:65126, https://access.redhat.com/errata/RHSA-2026:62260, https://access.redhat.com/errata/RHSA-2026:54435, https://access.redhat.com/errata/RHSA-2026:53806, https://access.redhat.com/errata/RHSA-2026:53646, https://access.redhat.com/errata/RHSA-2026:53645, https://access.redhat.com/errata/RHSA-2026:53644, https://access.redhat.com/errata/RHSA-2026:50085, https://access.redhat.com/errata/RHSA-2026:49701, https://access.redhat.com/errata/RHSA-2026:49700, https://access.redhat.com/errata/RHSA-2026:48151, https://access.redhat.com/errata/RHSA-2026:41951, https://access.redhat.com/errata/RHSA-2026:37390, https://access.redhat.com/errata/RHSA-2026:34608, https://access.redhat.com/errata/RHSA-2026:26586, https://access.redhat.com/errata/RHSA-2026:26018, https://access.redhat.com/errata/RHSA-2026:26017

    Affected packages

    Package

    Name: io.netty:netty-resolver-dns

    Purl: pkg:maven/io.netty/netty-resolver-dns

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 4.2.0.Final
    Fixed -4.2.15.Final

    Affected versions

    4.2.0.Final
    4.2.1.Final
    4.2.10.Final
    4.2.11.Final
    4.2.12.Final
    4.2.13.Final
    4.2.14.Final
    4.2.2.Final
    4.2.3.Final
    4.2.4.Final
    4.2.5.Final
    4.2.6.Final
    4.2.7.Final
    4.2.8.Final
    4.2.9.Final

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-5pvg-856g-cp85 | CVE-DB