CVE-2026-45673 Details
Description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.
A DNS cache poisoning vulnerability has been identified in Netty's DNS resolver, specifically in versions 4.1.134.Final and prior to 4.2.15.Final. The issue arises from the use of a predictable pseudo-random number generator (PRNG) for creating DNS transaction IDs, combined with a default static UDP source port. This combination decreases the randomness of DNS queries, making them susceptible to cache poisoning attacks, similar to the Kaminsky attack. The vulnerability allows downstream applications using the default Netty DNS resolver to connect to malicious IP addresses, potentially leading to traffic interception or man-in-the-middle attacks.
Users can upgrade to Netty versions 4.1.135.Final or 4.2.15.Final to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netty/netty/releases/tag/netty-4.1.135.Final | [email protected] | Release Notes |
| https://github.com/netty/netty/releases/tag/netty-4.2.15.Final | [email protected] | Release Notes |
| https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-330 | Use of Insufficiently Random Values | [email protected] |
| CWE-340 | Generation of Predictable Numbers or Identifiers | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netty netty | < 4.1.135 >= 4.2.0, < 4.2.15 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 12, 2026 | New CVE Received | [email protected] |