CVE-2026-45674
HIGHNetty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Title source: cnaDescription
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
References (13)
Core 13
Core References
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:41951
X_Refsource_Confirm x_refsource_confirm
https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc
X_Refsource_Misc x_refsource_misc
https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:26017
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:26018
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:26586
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-45674
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2488400
X_Refsource_Misc x_refsource_misc
https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:34608
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:37390
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:48151
Scores
CVSS v3
8.7
EPSS
0.0022
EPSS Percentile
13.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-345
CWE-346
Status
published
Products (5)
io.netty/netty-resolver-dns
0 - 4.1.135.FinalMaven
io.netty/netty-resolver-dns
4.2.0.Final - 4.2.15.FinalMaven
netty/netty
< 4.1.135
netty/netty
< 4.1.135.Final
netty/netty
>= 4.2.0.Final, < 4.2.15.Final
Published
Jun 12, 2026
Tracked Since
Jun 12, 2026