CVE-2026-45674: netty

CVSS: 10.0v3.1CriticalModified

AliasesUBUNTU-CVE-2026-45674DEBIAN-CVE-2026-45674CGA-22w3-g3gv-58f3+483 more

Published 12-06-2026Last modified 18-09-2026

Vulnerability summary

CVE-2026-45674 is a critical (CVSS 10.0) vulnerability in netty. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.3% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

10.0/10

010

Critical · v3.1 (NVD)

EPSS score

0.29%

0%100%

Low · +0.04 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 3

OPENSUSE-SU-2026:11033-1 RHSA-2026:49700 RHSA-2026:53644 RHSA-2026:53645 RHSA-2026:53646 RHSA-2026:76128+4 more

Timeline

12-06-2026
PublishedVulnerability first disclosed.
18-09-2026
Last modifiedVulnerability information updated.

Description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CVSS metrics

7 scores · 7 sources · 1 version

v3.110.0

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

20%

Versus all other CVEs

30-day change

+0.04 pp

From 0.25% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.29%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard176 products

airbyte-server< 2.0.0-r1
airbyte-server-fips< 2.0.0-r1
akhq< 0.27.1-r3
apache-hop< 2.18.0-r4
apache-hop-fips< 2.18.0-r4

apache-nifi< 2.9.0-r14
apache-pulsar-4.0< 4.0.11-r0
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.2-r3
apache-pulsar-fips-4.0< 4.0.11-r2
apache-pulsar-fips-4.1All versions (No fix recorded)
apicurio-registry< 3.3.0-r3
camunda-8.8< 8.8.27-r1
camunda-8.9< 8.9.6-r1
camunda-zeebe-8.6< 8.6.39-r6
camunda-zeebe-8.7< 8.7.30-r1
camunda-zeebe-8.8< 8.8.26-r0 | < 8.8.25-r1
camunda-zeebe-8.9< 8.9.6-r1
celeborn-0.5< 0.5.4-r25 | All versions (No fix recorded) | < 0.5.4-r26
celeborn-0.6All versions (No fix recorded) | < 0.6.3-r8 | < 0.6.3-r7
celeborn-0.7< 0.7.0-r4 | < 0.7.0-r3
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.17-r0
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3< 9.3.6-r0
commercial-elasticsearch-9.4< 9.4.3-r0
druid< 37.0.0-r12 | < 37.0.0-r56
elasticsearch-8.19< 8.19.16-r1
elasticsearch-8.19-iamguarded< 8.19.16-r1
elasticsearch-9.1All versions (No fix recorded)
elasticsearch-9.1-iamguardedAll versions (No fix recorded)
elasticsearch-9.1-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.2All versions (No fix recorded)
elasticsearch-9.2-iamguarded< 9.2.8-r13
elasticsearch-9.2-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.3< 9.3.7-r1
elasticsearch-9.3-iamguarded< 9.3.7-r1
elasticsearch-9.3-iamguarded-fips< 9.3.7-r1
elasticsearch-9.4< 9.4.2-r2
elasticsearch-9.4-iamguarded< 9.4.2-r2
elasticsearch-9.4-iamguarded-fips< 9.4.2-r3
elasticsearch-fips-8.19< 8.19.16-r1
elasticsearch-fips-9.1All versions (No fix recorded)
elasticsearch-fips-9.2All versions (No fix recorded)
elasticsearch-fips-9.3< 9.3.7-r1
elasticsearch-fips-9.4< 9.4.2-r3
flyway< 12.8.1-r4
flyway-fips< 12.8.1-r2
gremlin-server< 3.8.1-r2
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded) | < 3.5.0-r3
hono-adapter-mqtt< 2.7.0-r22
hono-cli< 2.7.0-r22
hono-service-auth< 2.7.0-r22
hono-service-command-router< 2.7.0-r22
hono-service-device-registry-jdbc< 2.7.0-r22
infinispan-15.0< 15.0.22-r11 | < 15.0.22-r10
infinispan-15.1< 15.1.7-r20
infinispan-15.2< 15.2.6-r19
infinispan-16.1< 16.1.4-r3
kafbat-ui< 1.5.0-r1
kafbat-ui-fips< 1.5.0-r6
kafka_exporter-strimzi-compat< 1.2.0-r4 | < 1.2.0-r5
kafka-bridge< 1.0.0-r6
kafka-bridge-fips< 1.0.0-r3
kafka-strimzi-compat< 1.2.0-r5
kayenta-2025.2All versions (No fix recorded)
kayenta-2025.4< 2025.4.6-r1
kayenta-2026.0< 2026.0.4-r1
kayenta-2026.1< 2026.1.1-r1
kayenta-fips-2025.2All versions (No fix recorded)
kayenta-fips-2025.4< 2025.4.3-r10
kayenta-fips-2026.0< 2026.0.4-r1
kayenta-fips-2026.1< 2026.1.1-r1
keycloak-26.4All versions (No fix recorded)
keycloak-26.4-iamguarded-compatAll versions (No fix recorded)
keycloak-26.4-operatorAll versions (No fix recorded)
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.5-operatorAll versions (No fix recorded)
keycloak-26.6< 26.6.3-r3
keycloak-26.6-iamguarded-compat< 26.6.3-r3
keycloak-26.6-operator< 26.6.3-r3
keycloak-fips-26.4All versions (No fix recorded)
keycloak-fips-26.4-iamguarded-fipsAll versions (No fix recorded)
keycloak-fips-26.4-operatorAll versions (No fix recorded)
keycloak-fips-26.5All versions (No fix recorded)
keycloak-fips-26.5-iamguarded-fipsAll versions (No fix recorded)
keycloak-fips-26.5-operatorAll versions (No fix recorded)
keycloak-fips-26.6< 26.6.3-r3
keycloak-fips-26.6-iamguarded-fips< 26.6.3-r2
keycloak-fips-26.6-operator< 26.6.3-r2
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r6
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r6
knative-kafka-broker-1.21-dispatcher-loom< 1.21.4-r4
knative-kafka-broker-1.21-receiver-loom< 1.21.4-r4
knative-kafka-broker-1.22-dispatcher-loom< 1.22.1-r4
knative-kafka-broker-1.22-receiver-loom< 1.22.1-r4
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r6
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r6
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.3-r10
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.3-r10
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.1-r4
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.1-r4
management-api-for-apache-cassandra-4.0< 0.1.117-r3
management-api-for-apache-cassandra-4.1< 0.1.117-r2
management-api-for-apache-cassandra-5.0< 0.1.120-r0
opensearch-2-repository-azure< 2.19.5-r1
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compat< 3.8.0-r3
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-repository-azure< 3.6.0-r7
opensearch-fips-3-repository-azure< 3.7.0-r0
pinot< 1.5.0-r16
pinot-fips< 1.5.0-r11
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
request-9047-keycloak-fips-26.4< 26.4.7-r17
request-9047-keycloak-fips-26.4-iamguarded-fips< 26.4.7-r17
request-9047-keycloak-fips-26.4-operator< 26.4.7-r17
request-9047-keycloak-fips-26.5< 26.5.7-r6
request-9047-keycloak-fips-26.5-iamguarded-fips< 26.5.7-r6
request-9047-keycloak-fips-26.5-operator< 26.5.7-r6
request-9047-keycloak-fips-26.6< 26.6.3-r2
request-9047-keycloak-fips-26.6-iamguarded-fips< 26.6.3-r2
request-9047-keycloak-fips-26.6-operator< 26.6.3-r2
s3proxy< 3.1.0-r9
s3proxy-fips< 3.1.0-r8
seata-server< 2.6.0-r13
selenium-server< 4.44.0-r2
sonarqube< 26.8.0.126808-r0
spark-4.0-scala-2.13< 4.0.3-r1
spark-4.1-scala-2.13< 4.1.2-r4
spark-fips-4.1-scala-2.13< 4.1.2-r3
spark-kubernetes-operator< 0.9.0-r1
spark-kubernetes-operator-fips< 0.9.0-r1
strimzi-kafka-operator< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-cluster-operator< 1.2.0-r4 | < 1.2.0-r5 | < 1.0.0-r6
strimzi-kafka-operator-fips-cluster-operator< 1.0.0-r3
strimzi-kafka-operator-fips-kafka-agent< 1.0.0-r3
strimzi-kafka-operator-fips-kafka-init< 1.0.0-r3
strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc< 1.0.0-r2
strimzi-kafka-operator-fips-topic-operator< 1.0.0-r3
strimzi-kafka-operator-fips-tracing-agent< 1.0.0-r3
strimzi-kafka-operator-fips-user-operator< 1.0.0-r3
strimzi-kafka-operator-kafka-agent< 1.2.0-r5 | < 1.0.0-r6
strimzi-kafka-operator-kafka-base< 1.2.0-r5
strimzi-kafka-operator-kafka-init< 1.0.0-r6 | All versions (No fix recorded) | < 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 1.2.0-r5 | < 1.0.0-r7
strimzi-kafka-operator-topic-operator< 1.2.0-r5 | < 1.2.0-r4 | < 1.0.0-r6
strimzi-kafka-operator-tracing-agent< 1.2.0-r5 | < 1.0.0-r6
strimzi-kafka-operator-user-operator< 1.0.0-r6 | < 1.2.0-r5
tez< 0.10.5-r16
thingsboard-tb-mqtt-transport< 4.3.1.2-r5
thingsboard-tb-node< 4.3.1.2-r5
trinoAll versions (No fix recorded)
trino-plugin-bigquery< 483-r7
trino-plugin-delta-lake< 481-r7
trino-plugin-exchange-filesystem< 481-r7
trino-plugin-exchange-hdfs< 481-r7
trino-plugin-hive< 481-r7
trino-plugin-hudi< 481-r7
trino-plugin-iceberg< 481-r7
trino-plugin-lakehouse< 481-r7
trino-plugin-opensearch< 483-r7
trino-plugin-oracle< 483-r7
trino-plugin-pinot< 481-r7
trino-plugin-spooling-filesystem< 481-r7
trino-plugin-teradata-functionsAll versions (No fix recorded)
wildfly-openjdk-17< 40.0.0-r3
wildfly-openjdk-21< 40.0.0-r3
zipkin< 3.6.1-r10
zipkin-slim< 3.6.1-r10

Show all 176

Wolfi24 products

akhq< 0.27.1-r3
apache-nifi< 2.9.0-r14
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.2-r3
apicurio-registry< 3.3.0-r3

Show all 24

2 vendors · 200 products · Showing 200 of 241. Use Open JSON for the complete list.

References

29 links

github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vcX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
github.com/netty/netty/releases/tag/netty-4.1.135.FinalX Refsource MISCREPORTWEBRelease Notes
github.com/netty/netty/releases/tag/netty-4.2.15.FinalX Refsource MISCREPORTWEBRelease Notes
access.redhat.com/security/cve/CVE-2026-45674VDB EntryX Refsource REDHATAdvisoryWEB
bugzilla.redhat.com/show_bug.cgi?id=2488400Issue TrackingX Refsource REDHATREPORTWEB
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.jsonX Sadp Csaf VexWEB
access.redhat.com/errata/RHSA-2026:49700Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:53644Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:53645Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:48151Vendor AdvisoryX Refsource REDHATAdvisoryWEB

Show all 29 references

access.redhat.com/errata/RHSA-2026:53646Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:26586Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:41951Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:50085Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:49701Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:65126Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:62260Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:37390Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:26018Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:26017Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:34608Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:54435Vendor AdvisoryX Refsource REDHATAdvisoryWEB
ubuntu.com/security/CVE-2026-45674REPORT
www.cve.org/CVERecord?id=CVE-2026-45674REPORT
security-tracker.debian.org/tracker/CVE-2026-45674Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45674.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-45674Advisory
access.redhat.com/errata/RHSA-2026:53806AdvisoryWEB
github.com/netty/nettyPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities