CVE-2026-45674
criticalNetty is a network application framework for development of protocol servers and clients.
Vendor / product: Netty — netty
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
CVSS
10.0
10.0 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-06-12 15:16
Modified: 2026-09-18 13:18
NVD status: Modified
Last synced 3 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
netty / netty <4.1.135, ≥4.2.0 <4.2.15
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final security-advisories@github.com
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final security-advisories@github.com
- https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc security-advisories@github.com
- https://access.redhat.com/errata/RHSA-2026:26017 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:26018 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:26586 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:34608 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:37390 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:41951 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:48151 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:49700 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:49701 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:50085 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:53644 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:53645 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:53646 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:54435 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:62260 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:65126 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/security/cve/CVE-2026-45674 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://bugzilla.redhat.com/show_bug.cgi?id=2488400 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.json 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗