What’s Vulnerable › Vulnerabilities

CVE-2026-45674: Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-12 · updated 2026-09-18
• Weakness: CWE-345

Description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Affected products

• netty: before 4.1.135; from 4.2.0 before 4.2.15 — fixed in 4.1.135, 4.2.15

How to fix

Upgrade to a fixed version: netty 4.1.135, 4.2.15. Check the vendor advisory for mitigations.

References

• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
• https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc
• https://access.redhat.com/errata/RHSA-2026:26017
• https://access.redhat.com/errata/RHSA-2026:26018
• https://access.redhat.com/errata/RHSA-2026:26586
• https://access.redhat.com/errata/RHSA-2026:34608
• https://access.redhat.com/errata/RHSA-2026:37390
• https://access.redhat.com/errata/RHSA-2026:41951
• https://access.redhat.com/errata/RHSA-2026:48151
• https://access.redhat.com/errata/RHSA-2026:49700
• https://access.redhat.com/errata/RHSA-2026:49701

Get alerted when CVE-2026-45674 or the next vulnerability affects your stack