Insufficient verification of data authenticity in Netty - CVE-2026-47691

Vulnerability identifier: #VU133444

CSH Severity: High

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-47691

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to poison the DNS cache.

The vulnerability exists due to insufficient verification of data authenticity in the DnsResolveContext.AuthoritativeNameServerList handling of NS records when processing DNS responses containing NS records in the AUTHORITY section and A records in the ADDITIONAL section. A remote attacker can provide crafted DNS records to poison the DNS cache.

Exploitation requires control of an authoritative name server for a subdomain, and the poisoned cache can affect future resolutions under the parent domain.

Netty
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Development Tools Module
SUSE Package Hub 15
Netezza Appliance
Maximo Application Suite - Monitor Component
webMethods developer portal
webMethods ControlPlane
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
IBM SPSS Analytic Server
IBM Sterling Connect:Direct Web Services
netty-tcnative
netty-tcnative-debugsource
netty-javadoc
netty
Red Hat Camel for Spring Boot
JBoss Data Grid

Install security update from vendor's website.

Netty - addressed in versions 4.1.135, 4.2.15
Netezza Appliance - update to 1.0.2.0
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.20, 6.4.0.9
Maximo Application Suite - Monitor Component - addressed in versions 9.0.23, 9.1.13, 9.2.1
webMethods developer portal - update to 11.1 Fix14
webMethods ControlPlane - update to 11.1 Fix11
netty-tcnative - update to 2.0.79-150200.3.45.1
netty-tcnative-debugsource - update to 2.0.79-150200.3.45.1
netty-javadoc - update to 4.1.135-150200.4.50.1
netty - update to 4.1.135-150200.4.50.1
Red Hat Camel for Spring Boot - update to 4.18
watsonx Assistant Cartridge - update to 5.4.2
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.4.2
JBoss Data Grid - update to 8.6.2

• https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85

• Multiple vulnerabilities in Netty
• Multiple vulnerabilities in IBM SPSS Analytic Server
• SUSE update for netty, netty-tcnative
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
• Multiple vulnerabilities in JBoss Data Grid 8.6
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM webMethods API Management
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge