CVE-2026-47691
ADVISORY - githubSummary
Summary
Netty's DnsResolveContext insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like .co.uk).
Details
In io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName.
This means if the resolver queries evil.co.uk., it will accept an NS record claiming authority over co.uk.. Subsequently, the handleWithAdditional method caches the associated A records from the ADDITIONAL section directly into the authoritativeDnsServerCache under the parent domain's key (co.uk.). This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under co.uk..
The io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#cache method only prevents caching if the record is for the root zone (dots == 1).
Impact
DNS Cache Poisoning. Any application using Netty's DNS resolver is impacted.
Common Weakness Enumeration (CWE)
Insufficient Verification of Data Authenticity
NIST
2.2
CVSS SCORE
8.7highGitHub
CVSS SCORE
8.7highDebian
-
Ubuntu
3.9
CVSS SCORE
10mediumChainguard
CGA-m9gr-j2wg-ggpw
-
minimos
MINI-23jr-82fm-w3r9
-
minimos
MINI-23qm-rvp6-3mw5
-
minimos
MINI-25gv-74gc-xfxc
-
minimos
MINI-2pvv-x9hv-cmjc
-
minimos
MINI-32f5-7j6f-9fcr
-
minimos
MINI-375c-69p8-gr49
-
minimos
MINI-3g77-3wg6-2jg4
-
minimos
MINI-3mc7-xj4p-w83x
-
minimos
MINI-3rr8-57w3-4pcp
-
minimos
MINI-3w5p-xcm3-gmvh
-
minimos
MINI-4qm5-vh7p-73hh
-
minimos
MINI-4v4x-6hw4-87cw
-
minimos
MINI-4x94-qrr5-qm74
-
minimos
MINI-5785-5jv5-252r
-
minimos
MINI-5mxc-xm3v-vxq5
-
minimos
MINI-5w3h-396m-hm74
-
minimos
MINI-6jwj-5hq8-3626
-
minimos
MINI-7wh6-v9xh-x2xc
-
minimos
MINI-84hw-rmgh-9m3v
-
minimos
MINI-8gcr-523p-27vp
-
minimos
MINI-8q5v-hv44-9j4v
-
minimos
MINI-93mv-3hq6-wrhm
-
minimos
MINI-99q3-jph7-8m6f
-
minimos
MINI-9h69-273x-6r9c
-
minimos
MINI-9j8h-jw55-v5jq
-
minimos
MINI-9p64-pc24-qx29
-
minimos
MINI-9x77-pg39-7rg7
-
minimos
MINI-c7m6-g35v-5473
-
minimos
MINI-c824-fxf2-4fmc
-
minimos
MINI-c92j-xq3p-p2rh
-
minimos
MINI-cc7c-7x2r-99v7
-
minimos
MINI-cwwq-36g4-c38m
-
minimos
MINI-f24j-xwjf-pc8w
-
minimos
MINI-f3xq-q964-hgqf
-
minimos
MINI-f58m-rw2h-f4hc
-
minimos
MINI-f7f7-jrxw-2phx
-
minimos
MINI-fc39-6qqp-5xvm
-
minimos
MINI-g443-hp3j-6j2x
-
minimos
MINI-gwfp-5qrp-wm6m
-
minimos
MINI-h44j-gpw8-hm37
-
minimos
MINI-hph6-77wg-8rjv
-
minimos
MINI-j3vr-6c3c-f84c
-
minimos
MINI-jhh5-px9r-jvw6
-
minimos
MINI-jw9w-w8hf-h3cx
-
minimos
MINI-m2wv-qh45-f3wf
-
minimos
MINI-mjm6-mjc2-985x
-
minimos
MINI-mm2g-rv4v-hf74
-
minimos
MINI-mpf9-grh3-f9j3
-
minimos
MINI-mrh4-x262-qvwj
-
minimos
MINI-mrp7-p2j7-mf58
-
minimos
MINI-p26x-4w9h-h6mm
-
minimos
MINI-p3xq-w293-f537
-
minimos
MINI-pj24-6xj6-f5mq
-
minimos
MINI-ppjr-5cjq-jg35
-
minimos
MINI-q5px-5pw2-9mc7
-
minimos
MINI-qfpp-73gp-2mpx
-
minimos
MINI-qr75-7hg6-3hmf
-
minimos
MINI-qwrc-cv87-qwpg
-
minimos
MINI-r2x3-v8hm-mjc8
-
minimos
MINI-r466-vchj-hj8w
-
minimos
MINI-rvr5-pphg-3x39
-
minimos
MINI-v252-wxw7-5hjc
-
minimos
MINI-v2rv-9359-65xh
-
minimos
MINI-vv9p-8rf2-c92r
-
minimos
MINI-w4xp-vr74-963m
-
minimos
MINI-w7g4-34r3-6w7v
-
minimos
MINI-wqmf-3xrv-phvh
-
minimos
MINI-wvg6-6qh4-f439
-
minimos
MINI-x4hx-g98g-mr66
-
minimos
MINI-xxw8-625x-h946
-