CVE Intelligence
Analysis AI-assisted

CVE-2026-45674: Netty DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Netty's DnsResolveContext does not validate the bailiwick (origin) of CNAME records in DNS responses, which the record describes as enabling DNS cache poisoning. NVD assigns a base score of 10 and GitHub-sourced scores are 8.7. The record states that versions 4.1.135.Final and 4.2.15.Final patch the issue, and the CVE is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-45674 affects Netty, a network application framework used to build protocol servers and clients. According to the record, its DnsResolveContext does not validate the bailiwick of CNAME records in DNS responses. The record classifies the weakness as CWE-345, Insufficient Verification of Data Authenticity.

Impact

  • The record describes a DNS cache poisoning scenario caused by accepting CNAME data outside the expected bailiwick.
  • NVD assigns a base score of 10 with a vector indicating network attack vector, low complexity, no privileges, no user interaction, scope change, and high confidentiality and integrity impact.
  • GitHub-sourced scores in the record are 8.7.
  • SSVC fields in the record list exploitation as none, automatable as no, and technical impact as total.

Affected products and versions

  • Product in the record: Netty (Netty Netty).
  • Affected ranges in the record: versions before 4.1.135.Final, and versions from 4.2.0.Final up to before 4.2.15.Final.
  • Fixed versions stated in the description and release notes: 4.1.135.Final and 4.2.15.Final.
  • The record's structured fixes field is empty, so the fixed versions above come from the description and the linked release notes.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.00292 with a percentile of 0.20649.

Remediation and mitigation

  • Upgrade Netty to 4.1.135.Final or 4.2.15.Final, depending on which release line your application uses.
  • Review the GitHub advisory and the vendor errata linked in the references to confirm the exact fixed build for your environment.
  • Where patching must be delayed, reduce exposure by limiting which DNS resolution paths and upstream resolvers the application relies on, and by reviewing applications that depend on Netty's DNS resolver.

Detection guidance

  • Inventory applications and dependencies that include Netty, including transitive dependencies, and record their versions.
  • Monitor for DNS resolution anomalies at a high level, such as unexpected CNAME chains that point to unrelated domains.

Limitations of the available information

  • The record does not describe a proof of concept, specific attack conditions, or default configurations of affected deployments.
  • The record does not say whether a particular application uses the affected DNS resolver code path.
  • The record does not explain the difference between the NVD score of 10 and the GitHub-sourced score of 8.7.

Frequently asked questions

What is the weakness in CVE-2026-45674?

According to the record, Netty's DnsResolveContext does not validate the bailiwick of CNAME records in DNS responses, which is classified as CWE-345.

Which versions fix this issue?

The record states that versions 4.1.135.Final and 4.2.15.Final patch the issue. Affected ranges are versions before 4.1.135.Final and versions from 4.2.0.Final up to before 4.2.15.Final.

Is this CVE known to be exploited in the wild?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.