The vulnerability in io.netty.resolver.dns.DnsResolveContext stems from insufficient bailiwick validation of CNAME records in DNS responses. Specifically, in the method buildAliasMap, the resolver caches all CNAME records found in the ANSWER section without verifying that the originator is authoritative for the queried domain name or a parent domain, as recommended by RFC 5452 section 6. This flaw enables DNS cache poisoning attacks via bailiwick bypass, impacting any application using Netty's DNS resolver.

Successful exploitation allows an attacker to poison the DNS cache of applications using Netty's DNS resolver by injecting malicious CNAME records that are not properly validated for origin authority. This can lead to clients resolving domain names to attacker-controlled IP addresses, resulting in potential confidentiality and integrity breaches. The CVSS vector indicates network attack complexity is high, no privileges or user interaction required, and the impact is high on confidentiality and integrity but not availability.

Red Hat has released security updates for their build of Quarkus that include fixes for this vulnerability by upgrading Netty to version 4.1.135.Final. Applying these updates (e.g., Quarkus 3.33.2.SP1 or 3.27.4.SP1) will remediate the issue. Users should ensure all relevant errata are applied before updating. No other specific mitigations are indicated in the vendor advisories. Patch status is confirmed via Red Hat advisories; users should apply the official fixes.