Loading vulnerability…
DNS cache poisoning in Netty DnsResolveContext
CVE-2026-45674 is a DNS cache-poisoning vulnerability in Netty's DNS resolver. DnsResolveContext fails to validate the authoritative origin, or bailiwick, of CNAME records in DNS responses before caching them. An attacker able to influence DNS responses processed by the resolver can introduce out-of-bailiwick CNAME records, poison cached resolution results, and potentially redirect application connections to attacker-controlled destinations. The issue affects Netty versions before the respective fixed releases 4.1.135.Final and 4.2.15.Final.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Poisoned DNS resolution can redirect applications to unintended or attacker-controlled servers, potentially enabling connection interception, information disclosure, and data manipulation. Downstream consequences depend on how the application uses resolved addresses and whether independent connection-authentication controls prevent impersonation.
If you can’t patch tonight, do this now.
Until an upgrade is possible, avoid the affected Netty DNS resolver for security-sensitive name resolution where feasible and use an alternative trusted resolution mechanism with appropriate DNS validation. Restrict opportunities for untrusted or attacker-influenced DNS responses to reach affected applications. These measures reduce exposure but do not correct the missing bailiwick validation.
Patch, then assume compromise.
Upgrade io.netty:netty-resolver-dns to 4.1.135.Final or later in the 4.1.x release line, or 4.2.15.Final or later in the 4.2.x release line. For products bundling Netty, install the vendor-supported release containing the corrected dependency rather than replacing bundled libraries independently. Identified fixed product releases include Red Hat JBoss EAP 7.4.25 and Confluence 10.2.18 LTS or 9.2.25 LTS. HCL Traveler 14.5.0.0 eliminates the affected dependency by removing Netty usage.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
57 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.