CVE-2026-45674: Netty DNS CNAME Validation Bypass (CVSS 8.7 HIGH)

Technical summary

The vulnerability resides in Netty's DnsResolveContext component, which handles DNS resolution. The flaw is a DNS origin validation (bailiwick) bypass affecting CNAME records. Bailiwick validation ensures that a DNS answer comes from an authoritative source—typically by verifying that the response originates from a nameserver responsible for the queried domain. Without this check, an attacker can craft a CNAME response that redirects queries to arbitrary domains. This is classified under CWE-345 (Insufficient Verification of Data Authenticity) and CWE-346 (Origin Validation Error), both DNS-class weaknesses. The attack requires network access but does not require user interaction, and carries a CVSS 3.1 score of 8.7 (HIGH) due to the combination of confidentiality and integrity impact across system boundaries.

Business impact

Applications built on Netty—particularly those handling sensitive protocols or making critical DNS lookups—face elevated risk of traffic interception and credential theft. Microservices architectures and cloud-native applications often rely on DNS for service discovery; a compromised DNS resolution could silently redirect requests to counterfeit endpoints. The impact extends beyond direct users to downstream consumers of APIs or services relying on these applications. Organizations running internet-facing or multi-tenant systems should prioritize assessment and patching to avoid potential data exfiltration, session hijacking, or supply chain compromise through poisoned DNS responses.

Affected systems

Netty versions prior to 4.1.135.Final and 4.2.15.Final are affected. Both the 4.1.x (legacy) and 4.2.x (current) release branches require updates. Organizations should inventory all applications and libraries that depend on Netty—including frameworks, cloud SDKs, and microservice libraries that may embed Netty transitively—to identify exposure across their infrastructure.

Exploitability

Exploitation requires network access (on-path positioning or DNS server control) and no user interaction, but the attack complexity is rated as HIGH due to the specific conditions needed to inject forged CNAME records successfully. While not currently listed in CISA's Known Exploited Vulnerabilities catalog, the relative simplicity of DNS spoofing attacks and the widespread use of Netty make timely patching important. An attacker would need to intercept or influence DNS traffic directed at the vulnerable application, then craft a malicious CNAME response—feasible in compromised network segments, rogue WiFi scenarios, or via BGP hijacking of DNS infrastructure.

Remediation

Upgrade to Netty 4.1.135.Final or later for the 4.1.x branch, or 4.2.15.Final or later for the 4.2.x branch. These releases include bailiwick validation logic for CNAME records. Organizations using Netty transitively through other dependencies (e.g., Spring Boot, gRPC, Kafka clients) should verify that the transitive dependency version meets the minimum threshold and coordinate updates with framework maintainers if needed.

Patch guidance

1. Identify all Netty dependencies in your build system (Maven, Gradle, etc.) and verify current versions. 2. Update Netty to version 4.1.135.Final (for 4.1.x lines) or 4.2.15.Final (for 4.2.x lines) or later. 3. Test DNS resolution behavior in your environment post-patch to ensure no unintended side effects. 4. For transitive dependencies, check release notes of consuming libraries (e.g., Spring Boot, gRPC, Kafka) to confirm they have released versions that include the patched Netty. 5. Prioritize internet-facing and multi-tenant applications, and those handling sensitive protocols or authentication flows.

Detection guidance

Monitor DNS query and response patterns for anomalies: unusually high rates of CNAME responses, CNAME records pointing to unexpected domains, or DNS lookups followed by connections to unexpected IP addresses. Log Netty DNS resolution events and cross-reference resolved IPs against expected service endpoints. Implement DNS filtering and monitoring at the network edge to detect potential poisoning attempts. In development environments, use DNS analysis tools to inspect Netty's behavior and confirm that origin validation is enforced post-patch. Consider security scanning during builds to detect outdated Netty versions before deployment.

Why prioritize this

This vulnerability merits HIGH priority due to its HIGH CVSS score (8.7), broad impact on confidentiality and integrity, and the ubiquity of Netty in cloud-native and microservice ecosystems. Although not yet in CISA's KEV list, DNS spoofing attacks are well-understood and relatively easy to execute in certain network positions, and the bypass of fundamental DNS security controls is a strong indicator of real-world risk. Organizations with internet-facing services or those handling sensitive data should patch within weeks, not months.

Risk score, explained

The CVSS 3.1 score of 8.7 reflects: (1) Network attack vector—no special access required; (2) High complexity—attacker must position on network or control DNS infrastructure, reducing immediacy; (3) No privilege or user interaction required; (4) Changed scope—impact extends beyond the vulnerable component to other systems relying on correct DNS resolution; (5) High confidentiality impact—redirected traffic can expose credentials and sensitive data; (6) High integrity impact—DNS responses are fundamentally corrupted, undermining trust in name resolution; (7) No availability impact—the service remains up but misdirected. The combination of cross-boundary integrity and confidentiality breaches in a network-accessible component justifies the HIGH rating.

Frequently asked questions