The vulnerability (CVE-2026-45674) in io.netty:netty-resolver-dns arises from insufficient bailiwick validation of CNAME records in DNS responses. Specifically, in the DnsResolveContext#buildAliasMap method, the resolver caches all CNAME records found in the ANSWER section without verifying that the originator is authoritative for the queried domain or its parent domains, violating RFC 5452 recommendations. This flaw enables DNS cache poisoning attacks by allowing malicious CNAME records to be accepted and cached improperly. The issue affects Netty versions >=4.2.0.Final <4.2.15.Final and all versions <4.1.135.Final. The vulnerability has a CVSS 3.1 score of 8.7 (high severity) with impact on confidentiality and integrity but no known exploits in the wild. Vendor advisories from Red Hat confirm the availability of patches in updated Netty versions (4.1.135.Final and later).

Successful exploitation allows an attacker to poison the DNS cache of applications using Netty's DNS resolver by injecting malicious CNAME records. This can lead to redirection of DNS queries to attacker-controlled domains, resulting in potential information disclosure and data manipulation. The CVSS score of 8.7 reflects high impact on confidentiality and integrity. There are no reports of active exploitation in the wild at this time.

A patch is available that fixes the bailiwick validation issue by upgrading Netty to version 4.1.135.Final or later. Users should apply the vendor-provided updates promptly. The Red Hat advisories for Red Hat build of Quarkus versions 3.27.4.SP1 and 3.33.2.SP1 include this fix. Before applying updates, ensure all previous relevant errata are applied. No additional mitigations are specified by the vendor.