CVE-2026-45674
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
- Score
- CVSS 3.1 10.0 Critical
- Status
- Modified - security-advisories@github.com
- Published
- 2026-06-12
- Last modified
- 2026-09-18
- Weaknesses
- CWE-345, CWE-346
Affected products
- Netty (Netty)
- Amq Streams (Redhat)
- Apache Camel Hawtio (Redhat)
- Apache Camel Quarkus (Redhat)
- Apache Camel Spring Boot (Redhat)
- Apicurio Registry (Redhat)
- Build Keycloak (Redhat)
- Camel Quarkus (Redhat)
- Cryostat (Redhat)
- Debezium (Redhat)
- Enterprise Linux Ai (Redhat)
- Jboss Data Grid (Redhat)
- Jboss Enterprise Application Platform (Redhat)
- Jboss Enterprise Application Platform Els (Redhat)
- Jboss Enterprise Application Platform Xp (Redhat)
- Jboss Fuse (Redhat)
- Jbosseapxp (Redhat)
- Openshift Ai (Redhat)
- Openshift Devspaces (Redhat)
- Quarkus (Redhat)
- Red Hat Single Sign On (Redhat)
- Serverless (Redhat)
References
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc
- https://access.redhat.com/errata/RHSA-2026:26017
- https://access.redhat.com/errata/RHSA-2026:26018
- https://access.redhat.com/errata/RHSA-2026:26586
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:49700
- https://access.redhat.com/errata/RHSA-2026:49701
- https://access.redhat.com/errata/RHSA-2026:50085
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/security/cve/CVE-2026-45674
- https://bugzilla.redhat.com/show_bug.cgi?id=2488400
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.json
