SB20261001160 - Ubuntu update for netty

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261001160

SB20261001160 - Ubuntu update for netty

Published: October 1, 2026

Security Bulletin ID SB20261001160
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Insufficient verification of data authenticity (CVE-ID: CVE-2026-47691)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to poison the DNS cache.

The vulnerability exists due to insufficient verification of data authenticity in the DnsResolveContext.AuthoritativeNameServerList handling of NS records when processing DNS responses containing NS records in the AUTHORITY section and A records in the ADDITIONAL section. A remote attacker can provide crafted DNS records to poison the DNS cache.

Exploitation requires control of an authoritative name server for a subdomain, and the poisoned cache can affect future resolutions under the parent domain.


Remediation

Install update from vendor's website.

References