{
  "cveId": "CVE-2026-47691",
  "url": "https://patchblox.com/security/cve/CVE-2026-47691",
  "summary": "CVE-2026-47691 is fixed in 7 products on 1 platform, first by libnetty-java 1:4.1.48-9ubuntu0.2\u002Besm2, released June 12, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "eap8-eap-product-conf-parent: Netty is a network application framework for development of protocol servers and clients",
  "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty\u0027s \u0060DnsResolveContext\u0060 insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like \u0060.co.uk\u0060). In \u0060io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add\u0060 method accepts any NS record from the AUTHORITY section as long as the record\u0027s name is a suffix of the questionName. Subsequently, the \u0060handleWithAdditional\u0060 method caches the associated A records from the ADDITIONAL section directly into the \u0060authoritativeDnsServerCache\u0060 under the parent domain\u0027s key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain\u0027s key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
  "published": "2026-06-12T09:16:00Z",
  "severity": "important",
  "cvss": 8.7,
  "epss": 0.00372,
  "epssPercentile": 0.31347,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "eap8-eap-product-conf-parent",
      "release": "RHEL 10",
      "fixedVersion": "801.7.1-1.GA_redhat_00001.1.el10eap",
      "fix": "RHSA-2026:49700",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-49700",
      "released": "2026-06-12T14:50:43Z"
    },
    {
      "platform": "linux",
      "product": "eap8-netty",
      "release": "RHEL 10",
      "fixedVersion": "4.1.135-1.Final_redhat_00001.1.el10eap",
      "fix": "RHSA-2026:49700",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-49700",
      "released": "2026-06-12T14:50:43Z"
    },
    {
      "platform": "linux",
      "product": "eap8-netty-transport-native-epoll",
      "release": "RHEL 10",
      "fixedVersion": "4.1.135-1.Final_redhat_00001.1.el10eap",
      "fix": "RHSA-2026:49700",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-49700",
      "released": "2026-06-12T14:50:43Z"
    },
    {
      "platform": "linux",
      "product": "eap8-wildfly",
      "release": "RHEL 10",
      "fixedVersion": "8.1.7.1-1.GA_redhat_00004.1.el10eap",
      "fix": "RHSA-2026:49700",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-49700",
      "released": "2026-06-12T14:50:43Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1:4.1.48-9ubuntu0.2\u002Besm2",
      "fix": "libnetty-java 1:4.1.48-9ubuntu0.2\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libnetty-java-1-4.1.48-9ubuntu0.2-esm2",
      "released": "2026-06-12T09:16:00Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "sles 15.7",
      "fixedVersion": "4.1.135-150200.4.50.1",
      "fix": "SUSE-SU-2026:2802-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2802-1",
      "released": "2026-07-08T19:06:43Z"
    },
    {
      "platform": "linux",
      "product": "netty-tcnative",
      "release": "sles 15.6",
      "fixedVersion": "2.0.79-150200.3.45.1",
      "fix": "SUSE-SU-2026:2802-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2802-1",
      "released": "2026-07-08T19:06:43Z"
    },
    {
      "platform": "linux",
      "product": "netty-tcnative",
      "release": "sles 15.7",
      "fixedVersion": "2.0.79-150200.3.45.1",
      "fix": "SUSE-SU-2026:2802-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2802-1",
      "released": "2026-07-08T19:06:43Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}