The vulnerability CVE-2026-28810 in Erlang/OTP kernel modules inet_res and inet_db arises from the generation of predictable 16-bit transaction IDs used in DNS UDP queries without source port randomization. This design flaw allows an attacker who can observe or predict transaction IDs to perform DNS cache poisoning attacks by forging DNS responses that pass validation checks. The affected OTP versions range from 17.0 through 28.4.2 and corresponding kernel versions. The resolver was designed for trusted network environments, but insufficient documentation may have led to its use in untrusted contexts. The CVSS 4.0 score is 6.3, indicating medium severity. No vendor advisory or patch information is currently available, and the vulnerability remains unmitigated officially.

An attacker capable of observing DNS queries or predicting transaction IDs can exploit this vulnerability to perform DNS cache poisoning, potentially redirecting DNS queries to malicious IP addresses. This undermines DNS integrity and can facilitate further attacks such as phishing or man-in-the-middle. The impact is limited by the requirement that the attacker can predict or observe the transaction ID and that the resolver is used in an environment where spoofed DNS responses are possible. The vulnerability affects multiple OTP versions and kernel releases.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should avoid deploying the inet_res DNS resolver in untrusted network environments where spoofed DNS responses are possible. Consider using alternative DNS resolvers that implement source port randomization and stronger transaction ID generation. Monitor vendor channels for updates or patches addressing this issue.