CVE-2026-45674

criticalpriority · attend · 50OT risk · highEPSS 0.003 · 21 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.29% (21st) EPSS

CVSS 10 · critical

Is it mine?

53 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-24

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.7–10

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 5.8

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.18.7highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.7highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Nsecondary · security-advisories@github.comexploitability 2.2 · impact 5.8

v3.18.7highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Nsecondaryexploitability 2.2 · impact 5.8

v3.18.7highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Nsecondary · OSV

v3.19.4criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-345USCWE-345USCWE-345USCWE-346USCWE-346US

exploits (1)

Public proof-of-concept and weaponised exploit code.

xiaoqiMikko/netty-resolver-dns-checkCVE-2026-45674 / CVE-2026-47691 / CVE-2026-45673: offline checker for DNS cache poisoning in io.netty:netty-resolver-dns - and whether your app actually uses that resolver. Spring WebClient on Reactor Netty uses it by default, although it is not in your pom.xml.PoC · poc_in_github

affected products (53)

Products and version ranges known to be affected.

Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Atlassian Bamboo≤ Data Center LTS <12.1.11cert_bundDE
Atlassian Bamboo≤ Data Center LTS <10.2.23cert_bundDE
Atlassian Bitbucket≤ Data Center LTS <10.2.6cert_bundDE
Atlassian Bitbucket≤ Data Center LTS <10.2.7cert_bundDE
Atlassian Bitbucket≤ Data Center LTS <9.4.24cert_bundDE
Atlassian Bitbucket≤ Data Center <10.4.2cert_bundDE
Atlassian Bitbucket≤ Data Center <10.4.3cert_bundDE
Atlassian Confluence≤ Data Center LTS <9.2.24cert_bundDE
Atlassian Confluence≤ Data Center LTS <10.2.17cert_bundDE
Atlassian Confluence≤ Data Center LTS <10.2.18cert_bundDE
Atlassian Confluence≤ Data Center LTS <9.2.25cert_bundDE
Atlassian Crucible< 4.9.14cert_bundDE
Atlassian Fisheye< 4.9.14cert_bundDE
Atlassian Jira≤ Data Center LTS <11.3.11cert_bundDE
Atlassian Jira≤ Service Management Data Center LTS <11.3.11cert_bundDE
Atlassian Jira≤ Service Management Data Center LTS <10.3.25cert_bundDE
Atlassian Jira≤ Data Center LTS <10.3.25cert_bundDE
netty netty≤ < 4.1.135.Finalenisa_euvdEU
netty netty4.2.0.Final, → 4.2.15.Finalenisa_euvdEU

showing 20 of 53

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1814Netty: Mehrere SchwachstellenDeutsch2026-06-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.
WID-SEC-W-2026-3376Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere SchwachstellenDeutsch2026-09-15csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, serverseitige Request-Forgery-Angriffe (SSRF) durchzuführen, Cross-Site-Scripting-Angriffe zu starten, sensible Informationen offenzulegen, Daten zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.
GHSA-676x-f7gg-47vcNetty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records2026-06-08ghsa · osvUS
### Summary Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. ### Details In `io.netty.resolver.dns.DnsResolveContext#buildAliasMap`, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds. According to https://datatracker.ietf.org/doc/html/rfc5452#section-6 ``` Care must be taken to only accept data if it is known that the originator is authoritative for the QNAME or a parent of the QNAME. One very simple way to achieve this is to only accept data if it is part of the domain for which the query was intended. ``` ### Impact DNS Cache Poisoning (Bailiwick Bypass). Any application using Netty's DNS resolver is impacted.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2026-06-12modified 2026-09-25

references (28)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan