CVE-2026-45674highCWE-345 CWE-346

CVE-2026-45674: high-severity vulnerability in netty

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Published 12 Jun 2026 · Updated 18 Sep 2026

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.3%

exploitation probability

0.3%top 80% of all CVEs

observed exploitation

nono source reports it

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected products

netty · netty

Related CVEs — netty

In the same product, most dangerous first.

CVE-2021-21409MEDIUMPossible request smuggling in HTTP/2 due missing validation of content-lengthEPSS 4.9%CVE-2021-43797MEDIUMHTTP fails to validate against control chars in header names which may lead to HTTP request smugglingEPSS 2.9%CVE-2023-34462MEDIUMnetty-handler SniHandler 16MB allocationEPSS 2.5%CVE-2025-24970HIGHSslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngineEPSS 2.2%CVE-2021-21290MEDIUMLocal Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary filesEPSS 1.8%CVE-2026-45416HIGHNetty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesEPSS 1.6%

References