~ / search / GHSA-676x-f7gg-47vc

GHSA-676x-f7gg-47vc

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Source: GitHub Advisory Database (reviewed) High CVE-2026-45674

Packages

EcosystemPackageAffectedFixed in
Maven io.netty:netty-resolver-dns >= 4.2.0.Final, < 4.2.15.Final 4.2.15.Final
Maven io.netty:netty-resolver-dns < 4.1.135.Final 4.1.135.Final

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. ### Details In `io.netty.resolver.dns.DnsResolveContext#buildAliasMap`, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds. According to https://datatracker.ietf.org/doc/html/rfc5452#section-6 ``` Care must be taken to only accept data if it is known that the originator is authoritative for the QNAME or a parent of the QNAME. One very simple way to achieve this is to only accept data if it is part of the domain for which the query was intended. ``` ### Impact DNS Cache Poisoning (Bailiwick Bypass). Any application using Netty's DNS resolver is impacted.

References

External links from the advisory. They lead to third-party sites.