Answer in brief
CVE-2026-45674 records a High severity (CVSS 8.7) security vulnerability in Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
Answer in brief
CVE-2026-45674 records a High severity (CVSS 8.7) security vulnerability in Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
Update io.netty:netty-resolver-dns to 4.2.15.Final; io.netty:netty-resolver-dns to 4.1.135.Final if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-45674 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| io.netty:netty-resolver-dnsmaven | >=4.2.0.Final,<=4.2.14.Final | 4.2.15.Final |
| io.netty:netty-resolver-dnsmaven | <=4.1.134.Final | 4.1.135.Final |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-45674 records a High severity (CVSS 8.7) security vulnerability in Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for io.netty:netty-resolver-dns, io.netty:netty-resolver-dns.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate io.netty:netty-resolver-dns to 4.2.15.Final; io.netty:netty-resolver-dns to 4.1.135.Final if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-45674 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| io.netty:netty-resolver-dnsmaven | >=4.2.0.Final,<=4.2.14.Final | 4.2.15.Final |
| io.netty:netty-resolver-dnsmaven | <=4.1.134.Final | 4.1.135.Final |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-45674 records a High severity (CVSS 8.7) security vulnerability in Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for io.netty:netty-resolver-dns, io.netty:netty-resolver-dns.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Summary Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. ### Details In `io.netty.resolver.dns.DnsResolveContext#buildAliasMap`, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds. According to https://datatracker.ietf.org/doc/html/rfc5452#section-6 ``` Care must be taken to only accept data if it is known that the originator is authoritative for the QNAME or a parent of the QNAME. One very simple way to achieve this is to only accept data if it is part of the domain for which the query was intended. ``` ### Impact DNS Cache Poisoning (Bailiwick Bypass). Any application using Netty's DNS resolver is impacted.
### Summary Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. ### Details In `io.netty.resolver.dns.DnsResolveContext#buildAliasMap`, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds. According to https://datatracker.ietf.org/doc/html/rfc5452#section-6 ``` Care must be taken to only accept data if it is known that the originator is authoritative for the QNAME or a parent of the QNAME. One very simple way to achieve this is to only accept data if it is part of the domain for which the query was intended. ``` ### Impact DNS Cache Poisoning (Bailiwick Bypass). Any application using Netty's DNS resolver is impacted.