by Kastro CVE-2026-45674
netty netty — Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Description · from the CVE record
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Affected
ProductAffectedFixed inSource
netty>= 4.2.0.Final, < 4.2.15.Final–CNA
netty< 4.1.135.Final–CNA
Cryostat 4 on RHEL 9see advisory4.2.0-13redhat-SADP
Cryostat 4 on RHEL 9see advisory4.2.0-13redhat-SADP
Cryostat 4 on RHEL 9see advisory4.2.0-13redhat-SADP
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1see advisoryresolver-dnsredhat-SADP
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16see advisoryresolver-dnsredhat-SADP
Red Hat build of Quarkus 3.27.4.SP1see advisoryresolver-dnsredhat-SADP
Red Hat build of Quarkus 3.33.2.SP1see advisoryresolver-dnsredhat-SADP
Red Hat Data Grid 8.6.2see advisoryresolver-dnsredhat-SADP
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7see advisory0:2.16.0-22.redhat_00057.1.el7eapredhat-SADP
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7see advisory0:2.3.14-11.SP11_redhat_00001.1.el7eapredhat-SADP
Scores by source
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
GitHub_M (CNA)8.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
redhat-SADP (CNA)8.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total