CVE-2026-45674Patch(netty / netty)

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch netty netty systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

netty CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc

Other references

Weakness type (CWE)

CWE-345CWE-346

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

netty

Threat summary

Patch or workaround signal is available
5 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 5 signals
Disclosure: 2 classified signals
Peaked 4d ago at 1 mentions (2026-06-12); latest day: 1
5 total mentions across 5 days

Affected systems

Vendors

netty

Products

netty

Deep dive

Activity timeline5 mentions / 5d

Signal classification2 categories

Patch

360.0%

Disclosure

240.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-12	1	Patch1
2026-06-13	1	Patch1
2026-06-20	1	Disclosure1
2026-07-29	1	Patch1
2026-09-23	1	Disclosure1

Full discourse5 posts

DNS基礎@beyondDNS34d
Disclosure
Grok: Netty の DNS リゾルバー（netty-resolver-dns） bailiwick（権威範囲）検証が欠如していた CVE-2026-45674
Post summary
The text provides initial disclosure-style details for CVE-2026-45674, identifying missing bailiwick/authority-scope validation in Netty's DNS resolver. No PoC, exploit, active exploitation, or remediation information is provided.
110311.0K
1.5K followersView on X
HeroDevs@herodevs90d
Patch
Past the last outpost, nobody rides out to resupply you. Netty http://4.1.135.Final patches 18 CVEs, 12 rated High. CVE-2026-45674 lets an off-path attacker poison DNS and redirect outbound traffic. NVD 10.0. EOL Spring Boot lines freeze their Netty 4.1 pin. https://t.co/VlvY1WaNGV
Post summary
The post announces Netty 4.1.135.Final, which addresses 18 CVEs (12 high), including CVE‑2026‑45674 that allows off‑path DNS poisoning; no PoC or active exploitation is reported.
10010171
2.7K followersView on X
ThreatAft@ThreatAft129d
Disclosure
🚨 CRITICAL: Netty DNS Resolver Flaws — Cache Poisoning Vulnerabilities CVE-2026-45673 (CVSS 6.8), CVE-2026-45674 (CVSS 8.7), CVE-2026-47691 (CVSS 8.7) 🔗 https://threataft.com/articles/netty-dns-resolver-cache-poisoning-vulnerabilities #CyberSecurity #ThreatIntel #infosec #Netty #Java
Post summary
Three new Netty DNS resolver cache‑poisoning vulnerabilities (CVE‑2026‑45673, CVE‑2026‑45674, CVE‑2026‑47691) are newly disclosed, with associated CVSS scores of 6.8 and 8.7.
0000083
31 followersView on X
ADK Cyber@ADKCyber136d
Patch
CVE-2026-45674 (CVSS 8.7): Netty DnsResolveContext issue before http://4.1.135.Final and http://4.2.15.Final. Check dependencies and update. http://adkcyber.com via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/rpalNSB8QK
Post summary
The tweet alerts about CVE-2026-45674, a high‑score Netty DnsResolveContext vulnerability affecting older versions, and urges users to update dependencies to remediate the issue.
0000033
93 followersView on X
𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_irc137d
Patch
Urgent! Netty DNS cache poisoning (CVE-2026-45674/45673) & ClipBucket SQLi (CVE-2026-49482) reported within the last hour. These critical vulns enable traffic interception & data exfiltration. High risk to privacy/integrity. Patch now! #Cybersecurity #NetworkSecurity #ZeroDay
Post summary
The tweet announces newly reported critical vulnerabilities (DNS cache poisoning and SQLi) and urges immediate patching, but provides no exploit details or evidence of active use.
0000037
15 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	netty	netty	-	-	-

Explore more

Back to dashboard netty CVEs netty vulnerabilities

What researchers are saying

CVE-2026-45674

HeroDevs[verified]@herodevsPatch

The post announces Netty 4.1.135.Final, which addresses 18 CVEs (12 high), including CVE‑2026‑45674 that allows off‑path DNS poisoning; no PoC or active exploitation is reported.

ADK Cyber[verified]@ADKCyberPatch

The tweet alerts about CVE-2026-45674, a high‑score Netty DnsResolveContext vulnerability affecting older versions, and urges users to update dependencies to remediate the issue.

DNS基礎@beyondDNSDisclosure

The text provides initial disclosure-style details for CVE-2026-45674, identifying missing bailiwick/authority-scope validation in Netty's DNS resolver. No PoC, exploit, active exploitation, or remediation information is provided.

ThreatAft@ThreatAftDisclosure

Three new Netty DNS resolver cache‑poisoning vulnerabilities (CVE‑2026‑45673, CVE‑2026‑45674, CVE‑2026‑47691) are newly disclosed, with associated CVSS scores of 6.8 and 8.7.

𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_ircPatch

The tweet announces newly reported critical vulnerabilities (DNS cache poisoning and SQLi) and urges immediate patching, but provides no exploit details or evidence of active use.