IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
8.7High

CVE-2026-45674Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1; Red Hat Red Hat build of Apache Camel 4.18.1.P1 f… Published: (5 months ago)

Description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Weakness (CWE): CWE-345CWE-346

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
amq streams 2.9 —
amq streams 3.2 —
cryostat 4 —
jboss enterprise application platform 8.1 —
jboss enterprise application platform els 7.4 —
netty netty >= 4.2.0.Final, < 4.2.15.Final, < 4.1.135.Final
openshift ai 2.25 —
openshift devspaces 3.30 —
quarkus 3.27 —
quarkus 3.33 —
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 all versions
Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 all versions
Red Hat Red Hat build of Quarkus 3.27.4.SP1 all versions
Red Hat Red Hat build of Quarkus 3.33.2.SP1 all versions
Red Hat Red Hat Data Grid 8.6.2 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA all versions
Red Hat Red Hat OpenShift AI 2.25 all versions
Red Hat Red Hat OpenShift Dev Spaces 3.30 all versions
Red Hat Streams for Apache Kafka 2.9.4 all versions
Red Hat Streams for Apache Kafka 3.2.1 all versions

References and patches

CPE matches (NVD) (2)
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* < 4.1.135
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.15