GHSA-676x-f7gg-47vc

Опубликовано: 08 июн. 2026

Источник: github

Github: Прошло ревью

CVSS3: 8.7

Описание

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Summary

Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses.

Details

In io.netty.resolver.dns.DnsResolveContext#buildAliasMap, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds.

According to https://datatracker.ietf.org/doc/html/rfc5452#section-6

Care must be taken to only accept data if it is known that the originator is authoritative for the QNAME or a parent of the QNAME. One very simple way to achieve this is to only accept data if it is part of the domain for which the query was intended.

Impact

DNS Cache Poisoning (Bailiwick Bypass). Any application using Netty's DNS resolver is impacted.

Ссылки

Пакеты

Наименование

io.netty:netty-resolver-dns

maven

Затронутые версииВерсия исправления

>= 4.2.0.Final, <= 4.2.14.Final

4.2.15.Final

Наименование

io.netty:netty-resolver-dns

maven

Затронутые версииВерсия исправления

<= 4.1.134.Final

4.1.135.Final

EPSS

Процентиль: 16%

0.00248

Низкий

8.7 High

CVSS3

CVE ID

CVE-2026-45674

Дефекты

CWE-345

CWE-346

Связанные уязвимости

CVE-2026-45674

CVSS3: 8.7

ubuntu

около 2 месяцев назад

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.