Netty prior 4.1.135.Final/4.2.15.Final AUTHORITY Section handleWithAdditional data authenticity

Summaryinfo

A vulnerability was found in Netty and classified as problematic. The affected element is the function handleWithAdditional of the component AUTHORITY Section. Such manipulation leads to data authenticity. This vulnerability is referenced as CVE-2026-47691. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Netty. Affected by this issue is the function handleWithAdditional of the component AUTHORITY Section. The manipulation with an unknown input leads to a data authenticity vulnerability. Using CWE to declare the problem leads to CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-47691 since 05/19/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 4.1.135.Final or 4.2.15.Final eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-36489) and CERT Bund (WID-SEC-2026-1814). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Open Source Netty

Productinfo

Name

• Netty

Website

• Product: https://github.com/netty/netty/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion