6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45673

CVE-2026-45673: Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45673

CVE-2026-45673:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-resolver-dns	maven	>= 4.2.0.Final, <= 4.2.14.Final	4.2.15.Final
io.netty:netty-resolver-dns	maven	<= 4.1.134.Final	4.1.135.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, DNS Cache Poisoning, is caused by two main factors in Netty's DNS resolver: the use of a predictable pseudo-random number generator (PRNG) for DNS query IDs and a default static source port for DNS queries. The combination significantly reduces the entropy needed to protect against DNS spoofing attacks.

The analysis of the provided patch commit a034a9e653ae5a391a8b2a9cbe06fd8928794e8f confirms this. The patch replaces all usages of java.util.concurrent.ThreadLocalRandom (aliased via PlatformDependent.threadLocalRandom()) with the cryptographically secure java.security.SecureRandom.

The primary vulnerable function is io.netty.resolver.dns.DnsQueryIdRange.pushId. Before the patch, this function used ThreadLocalRandom to shuffle returned DNS query IDs back into the available pool. Because ThreadLocalRandom is a linear congruential generator, its output is predictable if an attacker can observe a few generated numbers. This allows an attacker to predict future query IDs.

Additionally, the io.netty.resolver.dns.DnsQueryIdSpace.nextId function used the same weak PRNG to make decisions about allocating new ID buckets, further contributing to the predictability. By combining the predicted ID with the static source port (a behavior noted in the patch's comment changes to DnsNameResolverChannelStrategy), an attacker can craft a malicious DNS response that the resolver will accept, poisoning the DNS cache.

Vulnerable functions

io.netty.resolver.dns.DnsQueryIdRange.pushId

resolver-dns/src/main/java/io/netty/resolver/dns/DnsQueryIdSpace.java

The `pushId` method in the inner class `DnsQueryIdRange` uses `PlatformDependent.threadLocalRandom()`, which is a predictable PRNG, to determine the position to re-insert a returned DNS query ID. This makes the sequence of DNS query IDs predictable, which is the core of the vulnerability.

io.netty.resolver.dns.DnsQueryIdSpace.nextId

resolver-dns/src/main/java/io/netty/resolver/dns/DnsQueryIdSpace.java

The `nextId` method in `DnsQueryIdSpace` uses `PlatformDependent.threadLocalRandom()` to randomly decide whether to use an existing empty slot for a new ID bucket. This use of a predictable PRNG contributes to the overall predictability of the DNS query ID generation process.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.