CVE-2026-45674: Netty DNS cache poisoning via missing CNAME bailiwick validation

CVE-2026-45674 · Severity: high · CVSS 8.7 · Published 2026-06-12

Netty is a widely used networking framework that helps Java applications communicate over the internet. A security flaw in its DNS component allows attackers to provide fraudulent DNS information, potentially redirecting application traffic to malicious servers. This could lead to sensitive data being intercepted or users being sent to the wrong destination without the application realizing the connection has been compromised.

Technologies: io.netty:netty-resolver-dns (Maven), Netty Project Resolver DNS. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-45674 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45674 being exploited in the wild.
How severe is CVE-2026-45674?
High severity, with a CVSS score of 8.7, published 12 June 2026.
Which products and versions are affected?
io.netty:netty-resolver-dns (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final; Netty Project Resolver DNS >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final.
Is there a fix for CVE-2026-45674?
Yes. io.netty:netty-resolver-dns (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45674 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45674?
Check whether you run io.netty:netty-resolver-dns (Maven) or Netty Project Resolver DNS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-resolver-dns (Maven): upgrade to 4.2.15.Final or later
    # set io.netty:netty-resolver-dns to 4.2.15.Final in your pom.xml or build.gradle

Technical details

A DNS cache poisoning vulnerability exists in Netty's `netty-resolver-dns` module due to insufficient bailiwick validation. Specifically, `io.netty.resolver.dns.DnsResolveContext#buildAliasMap` processes and caches all CNAME records found in the ANSWER section of a DNS response without verifying if the responding server is authoritative for those records. An attacker capable of influencing DNS responses can inject arbitrary CNAME records into the resolver's cache. This bypasses the security recommendations in RFC 5452. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final by ensuring CNAMEs are only cached if they are part of the queried domain.

Affected products

  • Netty netty-resolver-dns <= 4.1.134.Final, 4.2.0.Final - 4.2.14.Final

Identifiers

  • CVE-2026-45674
  • GHSA-676x-f7gg-47vc

Timeline

  • 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released.
  • 2026-06-05: advisory: GitHub Security Advisory GHSA-676x-f7gg-47vc published.
  • 2026-06-12: disclosed: CVE-2026-45674 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.