CVE-2026-47691

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like .co.uk). In io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the handleWithAdditional method caches the associated A records from the ADDITIONAL section directly into the authoritativeDnsServerCache under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Summary

Netty's DnsResolveContext insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like .co.uk).

Details

In io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName.

This means if the resolver queries evil.co.uk., it will accept an NS record claiming authority over co.uk.. Subsequently, the handleWithAdditional method caches the associated A records from the ADDITIONAL section directly into the authoritativeDnsServerCache under the parent domain's key (co.uk.). This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under co.uk..

The io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#cache method only prevents caching if the record is for the root zone (dots == 1).

Impact

DNS Cache Poisoning. Any application using Netty's DNS resolver is impacted.

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-resolver-dns 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-45673, CVE-2026-45674, and CVE-2026-47691.

CVE-2026-45673: Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

CVE-2026-45674: Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

CVE-2026-47691: Netty has Insufficient Bailiwick Validation for NS Records

This patched artifact is a drop-in replacement for io.netty:netty-resolver-dns 4.1.100.Final from Maven Central.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like .co.uk). In io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the handleWithAdditional method caches the associated A records from the ADDITIONAL section directly into the authoritativeDnsServerCache under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

TuxCare rebuilt 8 io.netty packages to address 13 CVEs. Fixed in 4.1.115.Final-tuxcare.7.

TuxCare rebuilt 7 io.netty packages to address 10 CVEs. Fixed in 4.1.130.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 46 io.netty packages to address 22 CVEs. Fixed in 4.1.79.Final-tuxcare.4.

These are all security issues fixed in the netty-4.1.135-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2026-47691 in the io.netty:netty-resolver-dns package for Root:Maven. Multiple fixed versions available.

This update for netty, netty-tcnative fixes the following issue

This update for netty, netty-tcnative fixes the following issues

Upgrade netty to upstream version 4.1.135, netty-tcnative to upstream version 2.0.79:

• CVE-2026-44249: IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (bsc#1268165).
• CVE-2026-44250: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (bsc#1268169).
• CVE-2026-44890: Unbounded Direct Memory Consumption in RedisDecoder (bsc#1268170).
• CVE-2026-44893: netty-codec-haproxy: Denial of Service via malformed HAProxy message (bsc#1268244).
• CVE-2026-45416: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (bsc#1268246).
• CVE-2026-45536: Unix-socket fd receive leaks descriptors when peer sends two at once (bsc#1268247).
• CVE-2026-45673: netty-resolver-dns: DNS Cache Poisoning via predictable transaction IDs (bsc#1268248).
• CVE-2026-45674: DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (bsc#1268249).
• CVE-2026-46340: netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (bsc#1268250).
• CVE-2026-47244: HTTP/2: Advertised MAX_CONCURRENT_STREAMS not enforced (bsc#1268251).
• CVE-2026-47691: Insufficient Bailiwick Validation for NS Records (bsc#1268252).
• CVE-2026-48006: netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (bsc#1268255).
• CVE-2026-48043: netty-codec-http2: Denial of Service due to resource leak (bsc#1268257).
• CVE-2026-48059: netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol headers (bsc#1268258).
• CVE-2026-50010: Wrapping plain trust manager silently disables hostname verification (bsc#1268259).
• CVE-2026-50011: Unbounded pre-allocation in RedisArrayAggregator from RESP array length (bsc#1268260).
• CVE-2026-50020: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted (bsc#1268261).
• CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature (bsc#1268262).

Changes:

• MQTT: Allow MQTT 5 CONNECT with password only
• ChannelInitializer: correct misleading comment on exceptionCaught route
• HTTP/2: Parse request-target path like Vert.x (4.1 backport)
• HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
• IpSubnetFilter: Correctly handle ipv6
• Configurable bound on RedisArrayAggregator
• Redis: Limit decoded length
• DNS: Ensure query id is not predictible
• Wrapping plain trust manager silently disables hostname verification
• MQTT: Reject malformed no-payload packets with non-zero Remaining Length
• HAProxy: Reject HAProxyMessages with malformated TLV and not leak memory
• SSL: Use sane defaults as limits for the client hello length and timeout
• DNS: Only cache CNAME if part of the queried domain
• HTTP/2: Enforce max concurrent streams for misbehaving clients
• Dns: Insufficient Bailiwick Validation for NS Records
• HTTP2: DelegatingDecompressorFrameListener must release memory in all cases
• Pass maxAllocation to Brotli and Zstd decoders
• HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory
• Add maxWindowLog parameter to ZstdDecoder to bound memory allocation
• HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs
• Epoll / Kqueue: Correctly handle receive of FD
• SCTP: Limit the number of inflight incomplete SCTP messages and the number of fragments
• Redis: Correctly release incomplete message on removal when using RedisArrayAggregator
• Redis: Limit the maximum number of nested arrays
• HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake
• Marshalling: Explicit document security requirements
• Pin HTTP/RTSP version + method normalization to Locale.US
• Adaptive: Fix concurrency issue in adaptive allocator
• Pin multipart Content-Type / Content-Transfer-Encoding case…

It was discovered that Netty incorrectly validates the bailiwick of NS records. An attacker could possibly use this issue to facilitate DNS cache poisoning attacks.