CVE-2026-45674: Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Synopsis

A DNS cache poisoning vulnerability exists in Netty's DNS resolver, specifically in the DnsResolveContext component, which fails to validate whether CNAME records in DNS responses actually belong to the domain being queried (a check known as bailiwick validation). The vulnerability is remotely reachable over the network, requires no authentication, and involves no victim interaction, though exploitation is conditional on timing and network positioning due to high attack complexity. Successful exploitation lets an attacker redirect DNS resolution to attacker-controlled servers, enabling full compromise of confidentiality and integrity of data exchanged over connections the poisoned DNS entry governs. HarborGuard is tracking this advisory for patch availability, as no fix version has been published upstream at this time.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target's DNS resolution traffic over the network, positioning themselves to inject malicious DNS responses.

• AuthenticationNot required

  No credentials or prior account access are needed to attempt this attack; an unauthenticated network-positioned attacker can send crafted DNS responses.

• Victim interactionNot required

  No user action is required; exploitation targets the DNS resolver's automated response-processing logic without any human interaction.

• Attack complexityDetail

  Exploitation is rated high complexity, requiring the attacker to win a race condition or otherwise position themselves to deliver a forged DNS response before the legitimate reply arrives.

Blast Radius

• Redirects DNS resolution for targeted hostnames to attacker-controlled servers, allowing the attacker to intercept or proxy all application-layer traffic the affected service routes through those names.
• Reads plaintext or decryptable application data transmitted to the attacker's spoofed endpoint, including credentials, session tokens, and API payloads.
• Modifies data in transit by serving attacker-controlled responses, allowing tampering with any content the application fetches via the poisoned DNS entry.
• Scope extends beyond the originating container: because CVSS scope is changed, downstream services that trust the affected Netty resolver's answers are also exposed to misdirected traffic.