Executive brief
Netty is a widely used networking framework that helps Java applications communicate over the internet. A security flaw in its DNS component allows attackers to provide fraudulent DNS information, potentially redirecting application traffic to malicious servers. This could lead to sensitive data being intercepted or users being sent to the wrong destination without the application realizing the connection has been compromised.
Technical details
A DNS cache poisoning vulnerability exists in Netty's `netty-resolver-dns` module due to insufficient bailiwick validation. Specifically, `io.netty.resolver.dns.DnsResolveContext#buildAliasMap` processes and caches all CNAME records found in the ANSWER section of a DNS response without verifying if the responding server is authoritative for those records. An attacker capable of influencing DNS responses can inject arbitrary CNAME records into the resolver's cache. This bypasses the security recommendations in RFC 5452. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final by ensuring CNAMEs are only cached if they are part of the queried domain.
Affected products
- Netty netty-resolver-dns <= 4.1.134.Final, 4.2.0.Final - 4.2.14.Final
Timeline
- 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released.
- 2026-06-05: advisory: GitHub Security Advisory GHSA-676x-f7gg-47vc published.
- 2026-06-12: disclosed: CVE-2026-45674 published to NVD.