CVE-2026-47691: Netty has Insufficient Bailiwick Validation for NS Records

Synopsis

This is a DNS cache poisoning vulnerability in the Netty network application framework, affecting all versions prior to 4.1.135.Final and 4.2.15.Final. The flaw is reachable over the network without any authentication, and it is triggered when Netty's DNS resolver accepts NS records from a subdomain's authoritative name server without enforcing bailiwick rules, allowing those records to overwrite cached entries for parent domains. Successful exploitation lets an attacker redirect all DNS resolutions under a parent domain (such as .co.uk) to attacker-controlled servers, enabling traffic interception and data tampering across every hostname resolved under that domain. Fix versions 4.1.135.Final and 4.2.15.Final have been published upstream; a patched-image rebuild at those versions is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate a malicious authoritative name server reachable over the internet and must be in a position to respond to DNS queries directed at a subdomain they control.

• AuthenticationNot required

  No credentials or account of any kind are needed; the attack is conducted entirely through DNS protocol responses from a server the attacker controls.

• Victim interactionNot required

  No user or administrator action is required; the poisoning occurs automatically whenever the vulnerable Netty resolver queries a subdomain under the attacker's control.

• Attack complexityDetail

  Attack complexity is rated High because the attacker must control an authoritative name server for a relevant subdomain and time the DNS response correctly, introducing meaningful environmental preconditions beyond simply sending a packet.

Blast Radius

• An attacker redirects all future DNS lookups under a poisoned parent domain (for example, every hostname under .co.uk) to servers they control, allowing full interception of plaintext traffic to those hosts.
• Where TLS certificate validation is weak or absent, the attacker reads application-layer payloads including session tokens, API keys, and user credentials exchanged with any redirected hostname.
• The attacker serves modified responses to clients connecting to redirected hostnames, altering application data, injecting malicious content, or silently proxying and logging communications.