critical
CVE-2026-45674
netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
GHSA8.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Red Hat8.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (high), Ubuntu (medium).
Description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| chainguard | airbyte-server, airbyte-server-fips, akhq and 83 more | 2.0.0-r1 and 73 more |
| debian 11 | netty | no fix listed |
| debian 12 | netty | no fix listed |
| debian 13 | netty | no fix listed |
| debian 14 | netty | no fix listed |
| echo | netty | no fix listed |
| echo maven::Echo OSV | io.netty:netty-resolver-dns | 4.1.135.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-resolver-dns | 4.2.15.Final, 4.1.135.Final |
| minimos | apache-druid, apache-druid-fips, apache-iceberg-sink-connector and 39 more | 38.0.0-r0 and 24 more |
| rapidfort debian 12 | netty | no fix listed |
| rapidfort debian 13 | netty | no fix listed |
| ubuntu 18.04-ESM | netty | no fix listed |
Show all 160 entries from 13 sources
| Source | Package | Fixed in |
|---|---|---|
| chainguard | airbyte-server | 2.0.0-r1 |
| chainguard | airbyte-server-fips | 2.0.0-r1 |
| chainguard | akhq | 0.27.1-r3 |
| chainguard | apache-hop | 2.18.0-r4 |
| chainguard | apache-hop-fips | 2.18.0-r4 |
| chainguard | apache-nifi | 2.9.0-r14 |
| chainguard | apache-pulsar-4.0 | 4.0.11-r0 |
| chainguard | apache-pulsar-4.1 | 4.1.3-r15 |
| chainguard | apache-pulsar-4.2 | 4.2.2-r3 |
| chainguard | apache-pulsar-fips-4.0 | 4.0.11-r2 |
| chainguard | apicurio-registry | 3.3.0-r3 |
| chainguard | camunda-8.8 | 8.8.27-r1 |
| chainguard | camunda-8.9 | 8.9.6-r1 |
| chainguard | camunda-zeebe-8.6 | 8.6.39-r6 |
| chainguard | camunda-zeebe-8.7 | 8.7.30-r1 |
| chainguard | camunda-zeebe-8.8 | 8.8.26-r0 |
| chainguard | camunda-zeebe-8.9 | 8.9.6-r1 |
| chainguard | celeborn-0.5 | 0.5.4-r26 |
| chainguard | celeborn-0.6 | 0.6.3-r8 |
| chainguard | celeborn-0.7 | 0.7.0-r4 |
| chainguard | commercial-elasticsearch-8.19 | 8.19.17-r0 |
| chainguard | commercial-elasticsearch-9.3 | 9.3.6-r0 |
| chainguard | commercial-elasticsearch-9.4 | 9.4.3-r0 |
| chainguard | druid | 37.0.0-r56 |
| chainguard | elasticsearch-8.19 | 8.19.16-r1 |
| chainguard | elasticsearch-9.2 | 9.2.8-r13 |
| chainguard | elasticsearch-9.3 | 9.3.7-r1 |
| chainguard | elasticsearch-9.4 | 9.4.2-r2 |
| chainguard | elasticsearch-fips-8.19 | 8.19.16-r1 |
| chainguard | elasticsearch-fips-9.3 | 9.3.7-r1 |
| chainguard | elasticsearch-fips-9.4 | 9.4.2-r3 |
| chainguard | flyway | 12.8.1-r4 |
| chainguard | flyway-fips | 12.8.1-r2 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r3 |
| chainguard | hono | 2.7.0-r22 |
| chainguard | infinispan-15.0 | 15.0.22-r11 |
| chainguard | infinispan-15.1 | 15.1.7-r20 |
| chainguard | infinispan-15.2 | 15.2.6-r19 |
| chainguard | infinispan-16.1 | 16.1.4-r3 |
| chainguard | kafbat-ui | 1.5.0-r1 |
| chainguard | kafbat-ui-fips | 1.5.0-r6 |
| chainguard | kafka-bridge | 1.0.0-r6 |
| chainguard | kafka-bridge-fips | 1.0.0-r3 |
| chainguard | kayenta-2025.4 | 2025.4.6-r1 |
| chainguard | kayenta-2026.0 | 2026.0.4-r1 |
| chainguard | kayenta-2026.1 | 2026.1.1-r1 |
| chainguard | kayenta-fips-2025.4 | 2025.4.3-r10 |
| chainguard | kayenta-fips-2026.0 | 2026.0.4-r1 |
| chainguard | kayenta-fips-2026.1 | 2026.1.1-r1 |
| chainguard | keycloak-26.6 | 26.6.3-r3 |
| chainguard | keycloak-fips-26.6 | 26.6.3-r3 |
| chainguard | knative-kafka-broker-1.20 | 1.20.3-r6 |
| chainguard | knative-kafka-broker-1.21 | 1.21.4-r4 |
| chainguard | knative-kafka-broker-1.22 | 1.22.1-r4 |
| chainguard | knative-kafka-broker-fips-1.20 | 1.20.3-r6 |
| chainguard | knative-kafka-broker-fips-1.21 | 1.21.3-r10 |
| chainguard | knative-kafka-broker-fips-1.22 | 1.22.1-r4 |
| chainguard | management-api-for-apache-cassandra-4.0 | 0.1.117-r3 |
| chainguard | management-api-for-apache-cassandra-4.1 | 0.1.117-r2 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.120-r0 |
| chainguard | opensearch-2 | 2.19.5-r1 |
| chainguard | opensearch-3 | 3.8.0-r3 |
| chainguard | opensearch-fips-3 | 3.7.0-r0 |
| chainguard | pinot | 1.5.0-r16 |
| chainguard | pinot-fips | 1.5.0-r11 |
| chainguard | request-9047-keycloak-fips-26.4 | 26.4.7-r17 |
| chainguard | request-9047-keycloak-fips-26.5 | 26.5.7-r6 |
| chainguard | request-9047-keycloak-fips-26.6 | 26.6.3-r2 |
| chainguard | s3proxy | 3.1.0-r9 |
| chainguard | s3proxy-fips | 3.1.0-r8 |
| chainguard | seata | 2.6.0-r13 |
| chainguard | selenium | 4.44.0-r2 |
| chainguard | sonarqube | 26.8.0.126808-r0 |
| chainguard | spark-4.0 | 4.0.3-r1 |
| chainguard | spark-4.1 | 4.1.2-r4 |
| chainguard | spark-fips-4.1 | 4.1.2-r3 |
| chainguard | spark-kubernetes-operator | 0.9.0-r1 |
| chainguard | spark-kubernetes-operator-fips | 0.9.0-r1 |
| chainguard | strimzi-kafka-operator | 1.0.0-r7 |
| chainguard | strimzi-kafka-operator-fips | 1.0.0-r3 |
| chainguard | tez | 0.10.5-r16 |
| chainguard | thingsboard | 4.3.1.2-r5 |
| chainguard | tinkerpop | 3.8.1-r2 |
| chainguard | trino | 483-r7 |
| chainguard | wildfly | 40.0.0-r3 |
| chainguard | zipkin | 3.6.1-r10 |
| debian 11 | netty | no fix listed |
| debian 12 | netty | no fix listed |
| debian 13 | netty | no fix listed |
| debian 14 | netty | no fix listed |
| echo | netty | no fix listed |
| echo maven::Echo OSV | io.netty:netty-resolver-dns | 4.1.135.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-resolver-dns | 4.2.15.Final, 4.1.135.Final |
| minimos | apache-druid | 38.0.0-r0 |
| minimos | apache-druid-fips | 38.0.0-r0 |
| minimos | apache-iceberg-sink-connector | 1.12.0-r0 |
| minimos | apache-iceberg-sink-connector-fips | 1.12.0-r0 |
| minimos | apache-nifi | 2.10.0-r0 |
| minimos | apache-polaris | 1.6.0-r0 |
| minimos | apache-polaris-fips | 1.6.0-r0 |
| minimos | apicurio-registry | 3.3.1-r0 |
| minimos | apicurio-registry-fips | 3.3.1-r0 |
| minimos | camunda-8.8 | 8.8.29-r0 |
| minimos | cdc-apache-cassandra-5.0 | 2.3.9-r0 |
| minimos | cdc-apache-cassandra-fips-5.0 | 2.3.9-r0 |
| minimos | conductor | 3.32.1-r0 |
| minimos | conductor-fips | 3.32.1-r0 |
| minimos | datahub-frontend-react | 1.7.0-r0 |
| minimos | datahub-frontend-react-fips | 1.7.0-r0 |
| minimos | datahub-upgrade | 1.7.0-r0 |
| minimos | datahub-upgrade-fips | 1.7.0-r0 |
| minimos | elasticsearch-8.19 | 8.19.17-r0 |
| minimos | elasticsearch-9.4 | 9.4.3-r0 |
| minimos | elasticsearch-fips-8.19 | 8.19.17-r0 |
| minimos | elasticsearch-fips-9.4 | 9.4.3-r0 |
| minimos | keycloak | 26.6.3-r1 |
| minimos | keycloak-fips | 26.6.3-r1 |
| minimos | knative-kafka-broker-dispatcher-loom-1.22 | 1.22.2-r0 |
| minimos | knative-kafka-broker-dispatcher-loom-fips-1.22 | 1.22.2-r0 |
| minimos | knative-kafka-broker-receiver-loom-1.21 | 1.21.4-r1 |
| minimos | knative-kafka-broker-receiver-loom-1.22 | 1.22.2-r0 |
| minimos | knative-kafka-broker-receiver-loom-fips-1.22 | 1.22.2-r0 |
| minimos | linstor-server | 1.35.0-r0 |
| minimos | linstor-server-fips | 1.35.0-r0 |
| minimos | opensearch-2 | 2.19.6-r0 |
| minimos | opensearch-3 | 3.7.0-r0 |
| minimos | sonarqube | 26.8.0.126808-r0 |
| minimos | stargate | 2.0.51-r2 |
| minimos | strimzi-kafka-bridge | 1.0.0-r1 |
| minimos | strimzi-kafka-bridge-fips | 1.1.0-r0 |
| minimos | strimzi-kafka-operator | 1.0.1-r3 |
| minimos | strimzi-kafka-operator-0.45 | 0.45.2-r6 |
| minimos | strimzi-kafka-operator-fips | 1.0.1-r2 |
| minimos | trino | 481-r2 |
| minimos | trino-fips | 481-r2 |
| rapidfort debian 12 | netty | no fix listed |
| rapidfort debian 13 | netty | no fix listed |
| ubuntu 18.04-ESM | netty | no fix listed |
| wolfi | akhq | 0.27.1-r3 |
| wolfi | apache-nifi | 2.9.0-r14 |
| wolfi | apache-pulsar-4.1 | 4.1.3-r15 |
| wolfi | apache-pulsar-4.2 | 4.2.2-r3 |
| wolfi | apicurio-registry | 3.3.0-r3 |
| wolfi | celeborn-0.6 | 0.6.3-r8 |
| wolfi | druid | 37.0.0-r56 |
| wolfi | flyway | 12.8.1-r4 |
| wolfi | infinispan-16.1 | 16.1.4-r3 |
| wolfi | keycloak-26.6 | 26.6.3-r3 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.120-r0 |
| wolfi | opensearch-3 | 3.8.0-r3 |
| wolfi | selenium | 4.44.0-r2 |
| wolfi | sonarqube | 26.8.0.126808-r0 |
| wolfi | spark-4.0 | 4.0.3-r1 |
| wolfi | spark-4.1 | 4.1.2-r4 |
| wolfi | strimzi-kafka-operator | 1.0.0-r7 |
| wolfi | tez | 0.10.5-r16 |
| wolfi | thingsboard | 4.3.1.2-r5 |
| wolfi | trino | 483-r7 |
| wolfi | wildfly | 40.0.0-r3 |
| wolfi | zipkin | 3.6.1-r10 |
References
- https://access.redhat.com/errata/RHSA-2026:26017
- https://access.redhat.com/errata/RHSA-2026:26018
- https://access.redhat.com/errata/RHSA-2026:26586
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:49700
All 27 references
- https://access.redhat.com/errata/RHSA-2026:49701
- https://access.redhat.com/errata/RHSA-2026:50085
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/security/cve/CVE-2026-45674
- https://advisory.echohq.com/cve/CVE-2026-45674
- https://bugzilla.redhat.com/show_bug.cgi?id=2488400
- https://github.com/netty/netty
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc
- https://nvd.nist.gov/vuln/detail/CVE-2026-45674
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.json
- https://www.cve.org/CVERecord?id=CVE-2026-45674