CVE-2026-45673CWE-330CWE-340

Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

Medium · published June 12, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.4th percentile
Weaknesses
CWE-330 · Use of Insufficiently Random Values; CWE-340 · Generation of Predictable Numbers or Identifiers
Published
2026-06-12T14:16Z
EPSS history
Timeline
  • 12 JUN 14:16Z
    Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port
    cvelistv5