CVE-2026-45674: Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Summary Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses.
Details In io.netty.resolver.dns.DnsResolveContext#buildAliasMap, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds.
According to https://datatracker.ietf.org/doc/html/rfc5452#section-6
Care must be taken to only accept data if it is known that the originator is authoritative for the QNAME or a parent of the QNAME. One very simple way to achieve this is to only accept data if it is part of the domain for which the query was intended.
Impact DNS Cache Poisoning (Bailiwick Bypass). Any application using Netty's DNS resolver is impacted.
Other sources
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty:netty-resolver-dnsto a version that resolves this vulnerability.Fixed in 4.1.135.Final - Upgrade
Upgrade
maven/io.netty:netty-resolver-dnsto a version that resolves this vulnerability.Fixed in 4.2.15.Final - Upgrade
Upgrade
io.netty.resolver.dns.DnsResolveContextto a version that resolves this vulnerability.Fixed in 4.1.135.Final - Upgrade
Upgrade
io.netty.resolver.dns.DnsResolveContextto a version that resolves this vulnerability.Fixed in 4.2.15.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45674?
CVE-2026-45674 has a high severity rating of 8.7.
How do I fix CVE-2026-45674?
To mitigate CVE-2026-45674, update to the latest version of Netty that addresses this issue.
What does CVE-2026-45674 affect?
CVE-2026-45674 affects the Netty library specifically the netty-resolver-dns component.
What exploit does CVE-2026-45674 represent?
CVE-2026-45674 allows for DNS responses to be exploited due to improper validation of CNAME records.
When was CVE-2026-45674 published?
CVE-2026-45674 was published on June 8, 2026.