Skip to content
OpenAdvisories
High USN-8742-1 1 CVE

netty vulnerability

Published Sep 10, 2026 · Updated Sep 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Netty incorrectly validates the bailiwick of NS
records. An attacker could possibly use this issue to facilitate DNS
cache poisoning attacks.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS netty 1:4.1.48-9ubuntu0.2+esm2

Vulnerabilities 1

  • High 8.7
    CVE-2026-47691

    Netty has Insufficient Bailiwick Validation for NS Records

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An atta…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

References

  • report
    https://ubuntu.com/security/CVE-2026-47691