CVE-2026-45673

Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

Description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Scores

Faiblesses (CWE)

• CWE-330
• CWE-340

Avis

• GHSA-xmv7-r254-6q78 — Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

Références européennes

• ENISA EUVD · EUVD-2026-36445
• GCVE · GCVE-0-2026-45673

Avis du CERT-FR

• CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0933 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* < 4.1.135
• cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.15

Produits affectés

Références

• https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final

Sources