What is GHSA-676x-f7gg-47vc?

GHSA-676x-f7gg-47vc is a security advisory published by GitHub Security Advisories with High severity. Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Which CVE IDs does GHSA-676x-f7gg-47vc cover?

GHSA-676x-f7gg-47vc covers the following CVE IDs: CVE-2026-45674. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-676x-f7gg-47vc?

GHSA-676x-f7gg-47vc has a CVSS v3 base score of 8.7, published by GitHub Security Advisories.

Which products are affected by GHSA-676x-f7gg-47vc?

GHSA-676x-f7gg-47vc affects 2 products, including: maven/io.netty:netty-resolver-dns:\u003e= 4.2.0.Final, \u003c= 4.2.14.Final; maven/io.netty:netty-resolver-dns:\u003c= 4.1.134.Final.

GHSA-676x-f7gg-47vcHighCVSS 8.7

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Vendor

GitHub Security Advisories

Published

June 8, 2026

Last Modified

June 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-45674 →

📋 Description

Summary

Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses.

Details

In io.netty.resolver.dns.DnsResolveContext#buildAliasMap, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds.

According to https://datatracker.ietf.org/doc/html/rfc5452#section-6

Care must be taken to only accept
   data if it is known that the originator is authoritative for the
   QNAME or a parent of the QNAME.
   One very simple way to achieve this is to only accept data if it is
   part of the domain for which the query was intended.

Impact

DNS Cache Poisoning (Bailiwick Bypass). Any application using Netty's DNS resolver is impacted.

🎯 Affected products2

maven/io.netty:netty-resolver-dns:>= 4.2.0.Final, <= 4.2.14.Final
maven/io.netty:netty-resolver-dns:<= 4.1.134.Final