Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is a network application framework for development of protocol servers and clients. Prior to
    versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the
    bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name
    server for a subdomain can poison the cache for parent domains (like `.co.uk`). In
    `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record
    from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the
    `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into
    the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules,
    where a server authoritative for a subdomain should not be trusted to provide authoritative records for
    its parent. The poisoned cache is then used for all future resolutions under the parent domain's key.
    Versions 4.1.135.Final and 4.2.15.Final patch the issue. (CVE-2026-47691)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients. Prior to     versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the     bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name     server for a subdomain can poison the cache for parent domains (like `.co.uk`). In     `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record     from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the     `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into     the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules,     where a server authoritative for a subdomain should not be trusted to provide authoritative records for     its parent. The poisoned cache is then used for all future resolutions under the parent domain's key.
    Versions 4.1.135.Final and 4.2.15.Final patch the issue. (CVE-2026-47691)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
444480	SCA: security update for io.netty:netty-resolver-dns (GHSA-5pvg-856g-cp85)	Tenable Cloud Security	SCA Checks	critical
444480	SCA: security update for io.netty:netty-resolver-dns (GHSA-5pvg-856g-cp85)	Tenable Self-Hosted Container Security	SCA Checks	critical
320896	Linux Distros Unpatched Vulnerability : CVE-2026-47691	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-47691

critical

Tenable Plugins

critical

critical

critical