io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

🗓️ 20 Jul 2026 11:56:31Reported by RedHatType

redhat🔗 access.redhat.com👁 16 Views

Netty DNS resolver flaw allows parent cache poisoning via name server records validation.

Reporter	Title	Published	Views	Family All 676
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Streams	6 Sep 202614:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	23 Jul 202606:22	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance	10 Aug 202611:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to multiple Netty vulnerabilities (CVE-2026-45673, CVE-2026-45674, CVE-2026-47691)	21 Jul 202621:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	25 Jun 202617:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilies in Netty impacting IBM webMethods API Management	2 Sep 202613:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	18 Aug 202604:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	18 Jun 202606:07	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	7 Jul 202619:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:27	–	ibm

Vulners

Node

AND

redhat jboss_data_gridRange<8

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-47691
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/netty/netty/releases/tag/netty-4.1.135.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.15.Final
github	www.github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-47691
cve	www.cve.org/CVERecord

02 Oct 2026 18:46Current

7.6High risk

Vulners AI Score7.6

CVSS 3.18.7 - 10

EPSS0.00358

SSVC

netty framework domain name system cache poisoning parent domains bailiwick rules name server records