PT-2026-47610 · Netty · Netty

Published 2026-06-08 · Updated 2026-06-12 · CVE-2026-45674

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions prior to 4.2.15.Final

Description Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. In the buildAliasMap() function within io.netty.resolver.dns.DnsResolveContext, the resolver processes the ANSWER section of a DNS response and caches all found CNAME records without verification. This can lead to DNS Cache Poisoning (Bailiwick Bypass), where an attacker provides unauthorized DNS data for a domain they do not control.

Recommendations Update to version 4.1.135.Final Update to version 4.2.15.Final

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-45674

GHSA-676X-F7GG-47VC

Affected Products

Netty

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-45674 · Security Note
• https://osv.dev/vulnerability/GHSA-676x-f7gg-47vc · Vendor Advisory
• https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc · Note
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note
• https://twitter.com/YourAnon_irc/status/2065515246131794061 · Twitter Post