CVE-2026-47691

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>netty</name>
	<range><lt>4.1.135</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Netty is a network application framework for development of protocol
	servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,
	Netty's `DnsResolveContext` insufficiently validates the bailiwick of
	NS records, enabling DNS Cache Poisoning. An attacker controlling an
	authoritative name server for a subdomain can poison the cache for
	parent domains (like `.co.uk`). In
	`io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add`
	method accepts any NS record from the AUTHORITY section as long as the
	record's name is a suffix of the questionName. Subsequently, the
	`handleWithAdditional` method caches the associated A records from the
	ADDITIONAL section directly into the `authoritativeDnsServerCache`
	under the parent domain's key. This bypasses standard bailiwick rules,
	where a server authoritative for a subdomain should not be trusted to
	provide authoritative records for its parent. The poisoned cache is
	then used for all future resolutions under the parent domain's key.
	Versions 4.1.135.Final and 4.2.15.Final patch the issue.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-47691</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-47691</url>
    </references>
    <dates>
      <discovery>2026-06-12</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>