8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47691

CVE-2026-47691: Netty has Insufficient Bailiwick Validation for NS Records

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like .co.uk). In io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the handleWithAdditional method caches the associated A records from the ADDITIONAL section directly into the authoritativeDnsServerCache under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47691

CVE-2026-47691:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-resolver-dns	maven	>= 4.2.0.Final, <= 4.2.14.Final	4.2.15.Final
io.netty:netty-resolver-dns	maven	<= 4.1.134.Final	4.1.135.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the DnsResolveContext class, specifically within the AuthoritativeNameServerList inner class. The core of the issue is insufficient bailiwick validation for NS records, which can lead to DNS cache poisoning. An attacker controlling a subdomain's authoritative nameserver could provide malicious NS records for a parent domain. The vulnerable code would then cache these records, causing future DNS queries for the parent domain to be resolved to an attacker-controlled server.

The patch addresses this by adding a bailiwick check in the cache method of the AuthoritativeNameServerList class. This check ensures that an NS record is only cached if its domain is the same as or a subdomain of the queried domain. This prevents the cache from being poisoned with records for parent domains.

The add method is also implicated as it's the function that initially processes the NS records from the DNS response. While the fix is in the cache method, the add method is where the untrusted data is first handled. Therefore, both functions are relevant to understanding the vulnerability's exploitation.

Vulnerable functions

io.netty.resolver.dns.DnsResolveContext$AuthoritativeNameServerList.cache

resolver-dns/src/main/java/io/netty/resolver/dns/DnsResolveContext.java

The `cache` method in the `AuthoritativeNameServerList` inner class within `DnsResolveContext` was vulnerable. It cached NS records without proper bailiwick validation. This allowed an attacker controlling a subdomain's nameserver to poison the DNS cache for a parent domain. The patch introduces a check to ensure that the NS record's domain is a subdomain of the queried domain, preventing the poisoning.

io.netty.resolver.dns.DnsResolveContext$AuthoritativeNameServerList.add

resolver-dns/src/main/java/io/netty/resolver/dns/DnsResolveContext.java

The `add` method is where the vulnerable logic of accepting incorrect NS records begins. While the patch is in the `cache` method, the `add` method is the entry point for the malicious data. It processes the NS records from the AUTHORITY section of a DNS response. An attacker could craft a response where an NS record for a parent domain is included, and the `add` method would incorrectly accept it.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.