Loading vulnerability…
DNS cache poisoning via predictable transaction IDs in Netty DNS resolver
CVE-2026-45673 is a DNS cache poisoning vulnerability in Netty's netty-resolver-dns module affecting 4.1.x versions before 4.1.135.Final and 4.2.x versions before 4.2.15.Final. The resolver generates DNS transaction IDs using the predictable ThreadLocalRandom PRNG and, by default, reuses a static UDP source port through its ChannelPerResolver strategy. Together, these behaviors reduce DNS query entropy and allow attackers to forge matching responses, enabling Kaminsky-style DNS cache poisoning and redirection of application connections.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Poisoned DNS cache entries can cause applications relying on Netty's DNS resolver to connect to attacker-controlled destinations. This can enable traffic interception, machine-in-the-middle attacks, and potential disclosure or manipulation of application data, depending on independent transport authentication and application safeguards. The vulnerability can also facilitate exploitation of the separate CNAME validation vulnerability CVE-2026-45674.
If you can’t patch tonight, do this now.
If upgrading is temporarily infeasible, configure the DNS resolver to use ChannelStrategy.EPHEMERAL_PORT to restore UDP source-port randomization instead of reusing a static port. This reduces the predictability exploited by this vulnerability but does not correct the predictable transaction-ID generator or the separate DNS record-validation vulnerabilities.
Patch, then assume compromise.
Upgrade netty-resolver-dns to 4.1.135.Final or later in the 4.1.x branch, or 4.2.15.Final or later in the 4.2.x branch. Update direct and transitive Netty dependencies and redeploy affected applications. For products bundling Netty, install a vendor-supported release containing the fix.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.