Netty's DNS resolver component fails to enforce bailiwick checks on NS records in the AUTHORITY section, allowing an attacker who controls an authoritative name server for a subdomain to inject malicious A records for a parent domain. This is a CWE-345 vulnerability, indicating insufficient validation of the bailiwick of NS records. The flaw can be exploited to poison the Netty cache so that future resolutions for the parent domain use attacker‑controlled IP addresses, potentially enabling man‑in‑the‑middle attacks or traffic redirection.

The vulnerability affects Netty releases prior to 4.1.135.Final and 4.2.15.Final. Systems running these Netty versions in any network–intensive application are exposed.

The flaw carries a CVSS score of 8.7, indicating high severity. The EPSS score of less than 1% suggests exploitation is unlikely in the wild, and it is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be able to serve as an authoritative name server for a subdomain and to inject a parent‑domain cache entry through standard DNS query traffic to the vulnerable Netty instance.