CVE-2026-45673

Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

At a glance

Severity: MEDIUM 6.8
EPSS: EPSS 0.32 % · percentile 25 (2026-10-27)
State: PUBLISHED
Published: 2026-06-12
Updated: 2026-06-12
Assigner: GitHub_M
NVD status: Analyzed

Description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 6.8	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N	GitHub_M
CVSS 3.1	MEDIUM 6.8	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N	NVD · security-advisories@github.com (Secondary)

Weaknesses (CWE)

Advisories

GHSA-xmv7-r254-6q78 — Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

European references

ENISA EUVD · EUVD-2026-36445
GCVE · GCVE-0-2026-45673

CERT-FR advisories

CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-0933 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* < 4.1.135
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.15

Affected products

Product	Versions
netty · netty	affected >= 4.2.0.Final, < 4.2.15.Final ; affected < 4.1.135.Final

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD