PatchRadar

← Browse

CVE-2026-45674

Medium

Elevated severity or exploit probability.

CVSS base
8.7 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS — probability of exploitation (30 days)
0.2%
16.5th percentile
CISA KEV
Not listed
Weakness / dates
CWE-346
Published 2026-06-12 · modified 2026-09-18

CVSS breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack VectorNNetwork
Attack ComplexityHHigh
Privileges RequiredNNone
User InteractionNNone
ScopeCChanged
ConfidentialityHHigh
IntegrityHHigh
AvailabilityNNone

Timeline

Description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Affected

netty

References

Official: NVD · CVE.org