CVE-2026-28810: CWE-340 Generation of Predictable Numbers or Identifiers in Erlang OTP
Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers. inet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible. This vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl. This issue affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to kernel from 3.0 before 10.6.2, 10.2.7.4 and 9.2.4.11.
AI Analysis
Technical Summary
CVE-2026-28810 describes a CWE-340 vulnerability in Erlang/OTP's inet_res and inet_db modules where the DNS resolver uses a sequential, process-global 16-bit transaction ID for UDP DNS queries and lacks source port randomization. Response validation depends mainly on this predictable ID, making DNS cache poisoning feasible if an attacker can observe or predict the next ID. This behavior conflicts with RFC 5452 recommendations for DNS response validation. The vulnerability affects OTP versions from 17.0 before 28.4.2, 27.3.4.10, and 26.2.5.19, corresponding to kernel versions from 3.0 before 10.6.2, 10.2.7.4, and 9.2.4.11 respectively.
Potential Impact
The vulnerability allows an attacker capable of observing DNS queries or predicting transaction IDs to perform DNS cache poisoning, potentially redirecting DNS queries to malicious destinations. This undermines DNS integrity and trust in affected Erlang/OTP environments. The impact is limited to deployments where the built-in resolver is used in untrusted networks or with untrusted recursive resolvers, contrary to intended use.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid deploying the built-in inet_res DNS resolver in untrusted network environments or with untrusted recursive resolvers. Consider using alternative DNS resolvers that implement source port randomization and stronger transaction ID generation as recommended by RFC 5452.
CVE-2026-28810: CWE-340 Generation of Predictable Numbers or Identifiers in Erlang OTP
Description
Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers. inet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible. This vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl. This issue affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to kernel from 3.0 before 10.6.2, 10.2.7.4 and 9.2.4.11.
CVSS v4.0
Score 6.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-28810 describes a CWE-340 vulnerability in Erlang/OTP's inet_res and inet_db modules where the DNS resolver uses a sequential, process-global 16-bit transaction ID for UDP DNS queries and lacks source port randomization. Response validation depends mainly on this predictable ID, making DNS cache poisoning feasible if an attacker can observe or predict the next ID. This behavior conflicts with RFC 5452 recommendations for DNS response validation. The vulnerability affects OTP versions from 17.0 before 28.4.2, 27.3.4.10, and 26.2.5.19, corresponding to kernel versions from 3.0 before 10.6.2, 10.2.7.4, and 9.2.4.11 respectively.
Potential Impact
The vulnerability allows an attacker capable of observing DNS queries or predicting transaction IDs to perform DNS cache poisoning, potentially redirecting DNS queries to malicious destinations. This undermines DNS integrity and trust in affected Erlang/OTP environments. The impact is limited to deployments where the built-in resolver is used in untrusted networks or with untrusted recursive resolvers, contrary to intended use.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid deploying the built-in inet_res DNS resolver in untrusted network environments or with untrusted recursive resolvers. Consider using alternative DNS resolvers that implement source port randomization and stronger transaction ID generation as recommended by RFC 5452.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-03-03T14:40:00.590Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d4bd49aaed68159afc7f61
Added to database: 04/07/2026, 08:16:09 UTC
Last enriched: 07/24/2026, 21:34:05 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 117
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.