CVE-2026-45674
EUVD-2026-3645012.06.2026, 15:16
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| netty | netty | 𝑥 < 4.1.135 |
| netty | netty | 4.2.0 ≤ 𝑥 < 4.2.15 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 | resolver-dns ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 | resolver-dns ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Quarkus 3.27.4.SP1 | resolver-dns ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Quarkus 3.33.2.SP1 | resolver-dns ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Data Grid 8.6.2 | resolver-dns ≤ 𝑥 < * | ADP |
| Red Hat | Streams for Apache Kafka 2.9.4 | resolver-dns ≤ 𝑥 < * | ADP |
Debian Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| netty-tcnative |
|
Common Weakness Enumeration
- CWE-345 - Insufficient Verification of Data AuthenticityThe software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- CWE-346 - Origin Validation ErrorThe software does not properly verify that the source of data or communication is valid.
References