The vulnerability in io.netty.resolver.dns.DnsResolveContext arises because the method that adds NS records accepts any NS record from the AUTHORITY section if the record's name is a suffix of the queried domain name. This allows an attacker controlling a subdomain's authoritative name server to inject NS records for the parent domain, bypassing standard bailiwick rules. The resolver then caches malicious A records for the parent domain, leading to DNS cache poisoning. The cache method only prevents caching for the root zone, which is insufficient. This flaw impacts all applications using Netty's DNS resolver in affected versions.

This vulnerability enables DNS cache poisoning, which can lead to applications resolving domain names to attacker-controlled IP addresses. This can result in traffic interception, redirection, or other malicious activities depending on the application's use of DNS resolution. The impact is high as indicated by the CVSS score of 8.7 with high confidentiality and integrity impact and no required privileges or user interaction.

A patch is available that fixes this vulnerability by upgrading Netty to version 4.1.135.Final or later. Users should apply the update provided in Red Hat build of Quarkus versions 3.27.4.SP1 or 3.33.2.SP1, which include Netty 4.1.135.Final. Before applying the update, ensure all previously released errata relevant to your system are applied. No additional mitigation is required beyond applying the official fix.