Log in Start free

Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M

CVE-2026-45674Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

High 8.7

In plain English

A high-severity insufficient verification of data authenticity in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.3%top 78.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nettyno fix listedDEBIAN-CVE-2026-45674
Debian:13nettyno fix listedDEBIAN-CVE-2026-45674
Debian:14nettyno fix listedDEBIAN-CVE-2026-45674
Mavenio.netty:netty-resolver-dns4.1.135.FinalGHSA-676x-f7gg-47vc
Mavenio.netty:netty-resolver-dns4.2.15.FinalGHSA-676x-f7gg-47vc
Ubuntu:25.10nettyno fix listedUBUNTU-CVE-2026-45674
Ubuntu:26.10nettyno fix listedUBUNTU-CVE-2026-45674

Affected products (as reported)

VendorProductVersions
netty netty >= 4.2.0.Final, < 4.2.15.Final< 4.1.135.Final

Weakness: CWE-345, CWE-346 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

References