Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Priority MEDIUM 43CWE-345Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 24 fixed, 7 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.
Summary
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00292 21st percentileScored 2026-11-07
Fix Partial netty (netty): 4.2.15.Final, 4.1.135.Finalio.netty:netty-resolver-dns (Maven): 4.2.15.Final, 4.1.135.FinalRed Hat: 24 advisoriesRed Hat: 24 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| netty | netty | 4.2.0.Final to before 4.2.15.Final; before 4.1.135.Final | 4.2.15.Final, 4.1.135.Final | Patch available | CNA |
| — | io.netty:netty-resolver-dns (Maven) | 4.2.0.Final to before 4.2.15.Final | 4.2.15.Final | Patch available | GHSA-676x-f7gg-47vc |
| — | io.netty:netty-resolver-dns (Maven) | before 4.1.135.Final | 4.1.135.Final | Patch available | GHSA-676x-f7gg-47vc |
- netty Vendornetty Affected 4.2.0.Final to before 4.2.15.Final; before 4.1.135.Final Fixed in 4.2.15.Final, 4.1.135.Final Patch available CNA
- io.netty:netty-resolver-dns (Maven) Vendor— Affected 4.2.0.Final to before 4.2.15.Final Fixed in 4.2.15.Final Patch available GHSA-676x-f7gg-47vc
- io.netty:netty-resolver-dns (Maven) Vendor— Affected before 4.1.135.Final Fixed in 4.1.135.Final Patch available GHSA-676x-f7gg-47vc
Remediation
- Fix · CNA netty (netty) Fixed in 4.2.15.Final, 4.1.135.Final
- Fix · GHSA-676x-f7gg-47vc io.netty:netty-resolver-dns (Maven) Fixed in 4.2.15.Final Advisory →
- Fix · GHSA-676x-f7gg-47vc io.netty:netty-resolver-dns (Maven) Fixed in 4.1.135.Final Advisory →
Red Hat 24 advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:76128 Released 2026-10-06 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el7sso
- RHSA-2026:76130 Released 2026-10-06 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el9sso
Show 21 more Red Hat advisories
- RHSA-2026:76129 Released 2026-10-06 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el8sso
- RHSA-2026:76134 Released 2026-10-05 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 for OpenShift image security update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2026:76132 Released 2026-10-05 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update
- Red Hat Single Sign-On 7.6.13
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:62260 Released 2026-09-01 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.0 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
- RHSA-2026:54435 Released 2026-08-12 · Red Hat rating ImportantStreams for Apache Kafka 3.2.1 release and security update
- Streams for Apache Kafka 3.2.1
- RHSA-2026:53806 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 security update
- Red Hat JBoss Enterprise Application Platform 7.4.25
- RHSA-2026:53646 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 Security update
- Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el9eap +47
- RHSA-2026:53645 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 Security update
- Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el8eap +47
- RHSA-2026:53644 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 security pdate
- Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el7eap +47
- RHSA-2026:49700 Released 2026-08-03 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.7 security update
- Red Hat JBoss EAP 8.1 for RHEL 10 eap8-eap-product-conf-parent-801.7.1-1.GA_redhat_00001.1.el10eap, eap8-eap-product-conf-wildfly-ee-feature-pack-801.7.1-1.GA_redhat_00001.1.el10eap, eap8-netty-4.1.135-1.Final_redhat_00001.1.el10eap +17
- Red Hat JBoss EAP 8.1 for RHEL 8 eap8-eap-product-conf-parent-801.7.1-1.GA_redhat_00001.1.el8eap, eap8-eap-product-conf-wildfly-ee-feature-pack-801.7.1-1.GA_redhat_00001.1.el8eap, eap8-jose4j-0.9.6-2.redhat_00002.1.el8eap +19
- Red Hat JBoss EAP 8.1 for RHEL 9 eap8-eap-product-conf-parent-801.7.1-1.GA_redhat_00001.1.el9eap, eap8-eap-product-conf-wildfly-ee-feature-pack-801.7.1-1.GA_redhat_00001.1.el9eap, eap8-jose4j-0.9.6-2.redhat_00002.1.el9eap +19
- RHSA-2026:49701 Released 2026-08-03 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.7 security update
- Red Hat JBoss Enterprise Application Platform 8.1.7.GA io.netty.netty-codec-dns-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.135.Final-redhat-00001.jar, io.netty.netty-handler-4.1.135.Final-redhat-00001.jar +2
- RHSA-2026:48151 Released 2026-07-29 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
- RHSA-2026:41951 Released 2026-07-20 · Red Hat rating ImportantRed Hat Data Grid 8.6.2 security update
- Red Hat Data Grid 8.6.2
- RHSA-2026:37390 Released 2026-07-09 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18.1.P1 for Spring Boot release.
- Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
- RHSA-2026:34608 Released 2026-07-02 · Red Hat rating ImportantStreams for Apache Kafka 2.9.4 release and security update
- Streams for Apache Kafka 2.9.4
- RHSA-2026:30083 Released 2026-06-25 · Red Hat rating ImportantRed Hat build of Keycloak 26.6.4 Security Update
- Red Hat build of Keycloak 26.6.4
- RHSA-2026:30049 Released 2026-06-25 · Red Hat rating ImportantRed Hat build of Keycloak 26.4.13 Security Update
- Red Hat build of Keycloak 26.4.13
- RHSA-2026:26586 Released 2026-06-17 · Red Hat rating ImportantRed Hat build of Apache Camel 4.18 for Quarkus 3.33 security update
- Red Hat Build of Apache Camel 3.33.2.SP1 io.netty.netty-codec-haproxy-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.135.Final-redhat-00001.jar, io.netty.netty-handler-4.1.135.Final-redhat-00001.jar +3
- RHSA-2026:26018 Released 2026-06-17 · Red Hat rating ImportantRed Hat build of Quarkus 3.27.4.SP1 security update
- Red Hat build of Quarkus 3.27.4.SP1 io.netty.netty-codec-haproxy-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.135.Final-redhat-00001.jar +4
- RHSA-2026:26017 Released 2026-06-17 · Red Hat rating ImportantRed Hat build of Quarkus 3.33.2.SP1 security update
- Red Hat build of Quarkus 3.33.2.SP1 io.netty.netty-codec-haproxy-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.135.Final-redhat-00001.jar +4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Red Hat build of Debezium 3 | Affected | No fix planned: Will not fix |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2026:48151 |
| Middleware Containers for OpenShift | Fixed | RHSA-2026:76134 |
| Red Hat Build of Apache Camel 3.33.2.SP1 | Fixed | RHSA-2026:26586 |
| Red Hat Data Grid 8.6.2 | Fixed | RHSA-2026:41951 |
| Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server | Fixed | RHSA-2026:53644 |
| Red Hat JBoss EAP 8.1 for RHEL 10 | Fixed | RHSA-2026:49700 |
| Red Hat JBoss EAP 8.1 for RHEL 8 | Fixed | RHSA-2026:49700 |
| Red Hat JBoss EAP 8.1 for RHEL 9 | Fixed | RHSA-2026:49700 |
| Red Hat JBoss Enterprise Application Platform 7.4.25 | Fixed | RHSA-2026:53806 |
| Red Hat JBoss Enterprise Application Platform 8.1.7.GA | Fixed | RHSA-2026:49701 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:62260 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2026:76128 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2026:76129 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2026:76130 |
| Red Hat Single Sign-On 7.6.13 | Fixed | RHSA-2026:76132 |
| Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 | Fixed | RHSA-2026:37390 |
| Red Hat build of Keycloak 26.4.13 | Fixed | RHSA-2026:30049 |
| Red Hat build of Keycloak 26.6.4 | Fixed | RHSA-2026:30083 |
| Red Hat build of Quarkus 3.27.4.SP1 | Fixed | RHSA-2026:26018 |
| Red Hat build of Quarkus 3.33.2.SP1 | Fixed | RHSA-2026:26017 |
| Streams for Apache Kafka 2.9.4 | Fixed | RHSA-2026:34608 |
| Streams for Apache Kafka 3.2.1 | Fixed | RHSA-2026:54435 |
Not affected: 13 products
- Cryostat 4 on RHEL 9
- Red Hat Build of Apache Camel 3.33.2.SP1
- Red Hat Build of Keycloak
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat JBoss Enterprise Application Platform 8.1.7.GA
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3.30
- Red Hat build of Quarkus 3.27.4.SP1
- Red Hat build of Quarkus 3.33.2.SP1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-45674
- 2026-10-03 Alias added: GHSA-676x-f7gg-47vc
- 2026-10-06 Fix available: RHSA-2026:76134 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76132 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76129 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76130 · Red Hat
- 2026-10-06 Fix available: Middleware Containers for OpenShift, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9 +1 · Red Hat
- 2026-10-07 Fix available: RHSA-2026:76128 · Red Hat
- 2026-10-07 Fix available: Red Hat Single Sign-On 7.6 for RHEL 7 Server · Red Hat
- 2026-10-09 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
- 2026-10-13 Fix available: Red Hat Build of Apache Camel 3.33.2.SP1 · Red Hat
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-22 Affected versions changed · Red Hat
- 2026-10-23 Fix available: RHSA-2026:30049 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:30083 · Red Hat
- 2026-10-23 Fix available: Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6.4 · Red Hat
- 2026-11-01 Affected versions changed · Red Hat
References
Advisory 2
Other 23
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.json
- https://github.com/netty/netty
- https://bugzilla.redhat.com/show_bug.cgi?id=2488400
- https://access.redhat.com/security/cve/CVE-2026-45674
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:50085
- https://access.redhat.com/errata/RHSA-2026:49701
- https://access.redhat.com/errata/RHSA-2026:49700
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:26586
- https://access.redhat.com/errata/RHSA-2026:26018
- https://access.redhat.com/errata/RHSA-2026:26017
More Netty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
- TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
- TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
- TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
- TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
Sources
- CVE-2026-45674 · CVE Program
- CVE-2026-45674 · NVD
- FIRST EPSS
- GHSA-676x-f7gg-47vc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-45674 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences