The vulnerability in Netty's io.netty.resolver.dns.DnsResolveContext arises because the method that adds NS records from the DNS AUTHORITY section accepts any NS record whose name is a suffix of the queried domain name, without proper bailiwick validation. This allows an attacker controlling a subdomain's authoritative name server to inject NS records for the parent domain into the resolver's cache. The resolver then caches associated A records under the parent domain key, bypassing standard bailiwick rules that prevent subdomain servers from asserting authority over parent domains. This leads to DNS cache poisoning, where future DNS resolutions under the parent domain can be manipulated. The vulnerability affects any application using Netty's DNS resolver. Red Hat advisories indicate that the issue is fixed by upgrading Netty to version 4.1.135.Final in their Quarkus builds 3.27.4.SP1 and 3.33.2.SP1.

The vulnerability enables DNS cache poisoning, allowing an attacker who controls an authoritative name server for a subdomain to poison the DNS cache for parent domains. This can cause applications relying on Netty's DNS resolver to receive incorrect DNS responses, potentially leading to traffic interception, redirection, or denial of service. The CVSS v3.1 vector indicates network attack complexity is high, no privileges or user interaction required, with a scope change and high confidentiality and integrity impact but no availability impact.

Red Hat has released security updates for their build of Quarkus that include an upgrade of Netty to version 4.1.135.Final, which addresses this vulnerability. Users of Red Hat build of Quarkus versions 3.27.4.SP1 and 3.33.2.SP1 or later should apply these updates. Before applying these updates, ensure all prior relevant errata are applied. There is no indication that the vulnerability is mitigated without applying these updates. Patch status is confirmed by the vendor advisories. No additional mitigations are specified.