Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a… (CVE-2026-45673)
Description
Netty versions prior to 4.1.135.Final and 4.2.15.Final have a vulnerability in their DNS resolver where a predictable pseudo-random number generator (PRNG) is used for DNS transaction IDs and a static UDP source port is the default. This reduces the entropy of DNS queries and enables DNS cache poisoning attacks, such as the Kaminsky attack. The issue is patched in versions 4.1.135.Final and 4.2.15.Final.
CVSS v3.1
Score 6.8medium
Affected software
pkg:deb/ubuntu/netty?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/netty?arch=source&distro=esm-apps-legacy/xenialpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/netty?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/netty?arch=source&distro=questingpkg:deb/ubuntu/netty?arch=source&distro=stonkingpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Netty, a network application framework, had a vulnerability in its DNS resolver prior to versions 4.1.135.Final and 4.2.15.Final. The DNS resolver used a predictable PRNG for generating DNS transaction IDs and defaulted to a static UDP source port. This combination reduces the entropy of DNS queries, making them susceptible to DNS cache poisoning attacks (Kaminsky attack). The vulnerability is addressed by patches in versions 4.1.135.Final and 4.2.15.Final.
Potential Impact
The vulnerability allows attackers to perform DNS cache poisoning by predicting DNS transaction IDs and exploiting the static UDP source port, potentially redirecting DNS queries to malicious IP addresses. This can lead to interception or manipulation of network traffic relying on DNS resolution. The CVSS score is 6.8 (medium severity) with impact on integrity but no direct confidentiality or availability impact.
Mitigation Recommendations
Upgrade Netty to version 4.1.135.Final or later, or 4.2.15.Final or later, where the DNS resolver uses a secure PRNG and randomized UDP source ports. No other mitigation is required as the issue is fixed in these versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-45673
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:25.10","Ubuntu:26.10","Ubuntu:Pro:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ad3f6572cdf04f656665d35
Added to database: 10/17/2026, 22:27:35 UTC
Last enriched: 10/18/2026, 01:29:44 UTC
Last updated: 10/18/2026, 01:29:44 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.