{"id":"CVE-2026-45674","aliases":["GHSA-676x-f7gg-47vc"],"url":"https://o3.security/vulnerability/CVE-2026-45674","summary":"Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records","details":"### Summary\nNetty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses.\n\n### Details\nIn `io.netty.resolver.dns.DnsResolveContext#buildAliasMap`, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds.\n\nAccording to https://datatracker.ietf.org/doc/html/rfc5452#section-6 \n\n```\nCare must be taken to only accept\n   data if it is known that the originator is authoritative for the\n   QNAME or a parent of the QNAME.\n   One very simple way to achieve this is to only accept data if it is\n   part of the domain for which the query was intended.\n```\n\n### Impact\nDNS Cache Poisoning (Bailiwick Bypass). Any application using Netty's DNS resolver is impacted.","published":"2026-06-12T14:17:50.203Z","modified":"2026-10-28T02:31:14.521456803Z","cvss":{"score":8.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"},"epss":{"score":0.00248,"percentile":0.16341,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.netty:netty-resolver-dns","fixedVersion":"4.2.15.Final"},{"ecosystem":"Maven","name":"io.netty:netty-resolver-dns","fixedVersion":"4.1.135.Final"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"},{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26018"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26586"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34608"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37390"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:49700"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:49701"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50085"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53644"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53645"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53646"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54435"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-45674"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45674.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45674"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488400"},{"type":"PACKAGE","url":"https://github.com/netty/netty"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:53806"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:14.521456803Z"}}