CVE-2026-45673

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions prior to 4.2.15.Final

Description The DNS resolver in the io.netty.resolver.dns module uses a predictable Pseudo-Random Number Generator (PRNG) for generating DNS transaction IDs and defaults to a static UDP source port. Specifically, DnsQueryIdSpace manages transaction IDs using java.util.concurrent.ThreadLocalRandom, which is a predictable Linear Congruential Generator (LCG). Additionally, DnsNameResolverBuilder defaults to a channelStrategy of ChannelPerResolver, which binds the DatagramChannel once and results in a static source port for all subsequent queries. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning, also known as a Kaminsky attack, where an attacker can spoof DNS responses to redirect traffic to malicious IP addresses, potentially leading to man-in-the-middle attacks.

Recommendations Update to version 4.1.135.Final or later. Update to version 4.2.15.Final or later.