IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
8.7Alta

CVE-2026-47691Netty has Insufficient Bailiwick Validation for NS Records

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1; Red Hat Red Hat build of Apache Camel 4.18.1.P1 f… Publicada: (hace 5 meses)

Descripción

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Debilidad (CWE): CWE-345CWE-346

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
amq streams 2.9 —
amq streams 3.2 —
cryostat 4 —
jboss enterprise application platform 8.1 —
jboss enterprise application platform els 7.4 —
netty netty >= 4.2.0.Final, < 4.2.15.Final, < 4.1.135.Final
openshift ai 2.25 —
openshift devspaces 3.30 —
quarkus 3.27 —
quarkus 3.33 —
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 all versions
Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 all versions
Red Hat Red Hat build of Quarkus 3.27.4.SP1 all versions
Red Hat Red Hat build of Quarkus 3.33.2.SP1 all versions
Red Hat Red Hat Data Grid 8.6.2 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA all versions
Red Hat Red Hat OpenShift AI 2.25 all versions
Red Hat Red Hat OpenShift Dev Spaces 3.30 all versions
Red Hat Streams for Apache Kafka 2.9.4 all versions
Red Hat Streams for Apache Kafka 3.2.1 all versions

Referencias y parches

Coincidencias CPE (NVD) (2)
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* < 4.1.135
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.15