https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:19:08 +0000 https://vulnerability.circl.lu/vuln/ghsa-676x-f7gg-47vc <p><strong>Affected:</strong> Maven: io.netty:netty-resolver-dns</p> <p>### Summary Netty&#39;s DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses.</p> <p>### Details In `io.netty.resolver.dns.DnsResolveContext#buildAliasMap`, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds.</p> <p>According to https://datatracker.ietf.org/doc/html/rfc5452#section-6</p> <p>``` Care must be taken to only accept data if it is known that the originator is authoritative for the QNAME or a parent of the QNAME. One very simple way to achieve this is to only accept data if it is part of the domain for which the query was intended. ```</p> <p>### Impact DNS Cache Poisoning (Bailiwick Bypass). Any application using Netty&#39;s DNS resolver is impacted.</p> <p><strong>Affected:</strong> Maven: io.netty:netty-resolver-dns</p> <p>### Summary Netty&#39;s DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses.</p> <p>### Details In `io.netty.resolver.dns.DnsResolveContext#buildAliasMap`, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds.</p> <p>According to https://datatracker.ietf.org/doc/html/rfc5452#section-6</p> <p>``` Care must be taken to only accept data if it is known that the originator is authoritative for the QNAME or a parent of the QNAME. One very simple way to achieve this is to only accept data if it is part of the domain for which the query was intended. ```</p> <p>### Impact DNS Cache Poisoning (Bailiwick Bypass). Any application using Netty&#39;s DNS resolver is impacted.</p> https://vulnerability.circl.lu/vuln/ghsa-676x-f7gg-47vc