Security readout for executives and security teams
Plain-English summary
Netty, a widely used Java networking library, can be tricked into trusting fake DNS answers because it does not verify that CNAME records come from an authoritative source. An attacker who can influence DNS traffic could redirect application lookups to malicious hosts, potentially leaking data or steering users to attacker-controlled systems. Upgrading Netty fixes the flaw.
Executive priority
Treat as a high-priority patch cycle item within standard change windows. Business impact is elevated because Netty is embedded in many Java platforms, but no active exploitation is reported and attack complexity is high, so emergency change is not warranted absent internet-exposed DNS resolution paths.
Technical view
Netty's DnsResolveContext accepts CNAME records without enforcing bailiwick checks, allowing responses to reference names outside the queried zone's authority. This enables DNS cache poisoning against applications using Netty's DNS resolver. CVSS 3.1 is 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). Fixed in Netty 4.1.135.Final and 4.2.15.Final; Red Hat has issued multiple RHSA errata for affected middleware.
Likely exposure
Any Java service that uses Netty's built-in DNS resolver (directly or transitively via frameworks like Vert.x, gRPC, Spring, or Red Hat middleware) on versions below 4.1.135.Final or 4.2.x below 4.2.15.Final. Exposure grows for internet-facing resolvers and services relying on DNS for trust decisions.
Exploitation context
No KEV listing and no public reports of active exploitation in the provided sources. The advisory rates attack complexity as high, since the attacker must influence DNS responses, but the scope-changed impact on confidentiality and integrity makes downstream abuse credible once a poisoned entry is cached.
Researcher notes
Root cause is missing bailiwick validation in DnsResolveContext for CNAME chains (CWE-345, CWE-346). Confirm whether your services use netty-resolver-dns directly or through wrappers, and evaluate cache TTLs that could extend poisoning windows. Red Hat has issued multiple errata, so map affected middleware (JBoss EAP, AMQ, Data Grid, etc.) against RHSAs listed in the advisory bundle.
Mitigation direction
- Upgrade Netty to 4.1.135.Final or 4.2.15.Final across all applications and container base images.
- Apply Red Hat RHSA-2026:26017, 26018, 26586, 34608, and 37390 where middleware is affected.
- Inventory transitive Netty dependencies in Java builds using SBOM or dependency scanners.
- Restrict outbound DNS to trusted, validating resolvers and enforce DNSSEC where feasible.
- Consult vendor guidance for products embedding Netty that lack a direct upgrade path.
Validation and detection
- Query build manifests for io.netty artifacts and confirm versions meet the fixed releases.
- Scan runtime containers and JARs for older netty-resolver-dns modules.
- Review Red Hat CSAF VEX data to confirm status for deployed Red Hat products.
- Check application logs and DNS telemetry for anomalous CNAME resolutions.
- Re-run SCA scans after patching to confirm CVE-2026-45674 no longer flags.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-345: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-346: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-45674 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N2.25.8GitHub_MCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N2.25.8redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.7HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Base CVSS 3.1 score
8.7HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-06-12T15:02:15.565Z: Reported to Red Hat.
- 2026-06-12T14:17:50.203Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vcCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/netty/netty/releases/tag/netty-4.1.135.FinalCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.2.15.FinalCVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-45674CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2488400CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:26586CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37390CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26018CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26017CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34608CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Origin Validation Error
Origin Validation Error represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.