CVE-2026-47691 is a DNS cache poisoning flaw in Netty's DNS resolver, scored CVSS 8.7 (high). A name server for a subdomain can plant records for a parent domain. Netty fixed it in 4.1.135.Final and 4.2.15.Final, so upgrade netty-resolver-dns and check anything that bundles it.
What's affected
The GitHub advisory lists the Maven artifact io.netty:netty-resolver-dns with these ranges:
- 4.2.0.Final through 4.2.14.Final
- 4.1.134.Final and earlier
The patched versions are 4.1.135.Final and 4.2.15.Final. The advisory lists no workarounds, so upgrading is the remedy it describes.
The NVD vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. High complexity reflects that the attacker must control an authoritative name server that your application ends up querying.
Any application that uses Netty's DNS resolver is in scope, which includes many Java servers and clients, and frameworks that embed Netty such as reactive HTTP clients.
How to check if you're exposed
Find the resolved Netty version in every build.
Maven:
mvn dependency:tree -Dincludes=io.netty:netty-resolver-dns
Gradle:
gradle dependencies --configuration runtimeClasspath | grep netty-resolver-dns
For a deployed jar, list the bundled libraries with unzip -l app.jar | grep -i netty-resolver-dns or look in the fat jar's BOOT-INF/lib directory.
Compare the result with the ranges above. Also check that your application actually uses the DNS resolver. Netty only uses its own resolver when the application sets it up, either directly or through a framework option. A reachability analysis answers that question for your code.
What to do now
- Run the dependency commands above for each Java service and note the netty-resolver-dns version.
- Upgrade to 4.1.135.Final or 4.2.15.Final, depending on your line. Use the Netty BOM so related modules move together.
- Rebuild and redeploy, including container images that carry a fat jar.
- Check frameworks that pin Netty through their own BOM and update them if they hold you back.
- If you cannot upgrade yet, note that the advisory offers no workaround and prioritize services that resolve names from untrusted zones.
Why it matters
The weakness is CWE-345, insufficient verification of data authenticity, and CWE-346, origin validation error. Per the advisory, a method that collects name server records accepted any NS record from the authority section as long as the record's name was a suffix of the question name. Records for the parent domain, such as co.uk, could then be cached from a server that should only speak for a subdomain.
DNS resolvers normally apply bailiwick rules, meaning a server is trusted only for names inside its own zone. Skipping that check lets one hostile zone influence lookups for others. The poisoned entry is used for later resolutions under the parent key. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-47691 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
Does upgrading Netty core fix it?
The fix is in the netty-resolver-dns artifact, which ships as part of the Netty release train. Upgrade it to a patched version and confirm with the dependency tree.
Sources
Last reviewed: 19 October 2026.
