Executive brief
Netty is a widely used networking framework that helps Java applications communicate over the internet. A security flaw in its DNS component makes it easier for attackers to redirect network traffic to malicious servers by guessing the identifiers used in web lookups. This could allow an attacker to intercept sensitive data or impersonate legitimate services without the user's knowledge.
Technical details
The vulnerability exists in the io.netty.resolver.dns component. It stems from two primary issues: the use of a predictable PRNG (ThreadLocalRandom) for generating 16-bit DNS transaction IDs and a default configuration (ChannelPerResolver) that uses a static UDP source port. This lack of entropy allows a remote attacker to predict query identifiers and perform DNS cache poisoning. An exploit could lead to traffic redirection or Man-in-the-Middle (MitM) attacks. The issue is resolved in versions 4.1.135.Final and 4.2.15.Final by ensuring query IDs are non-predictable and improving port randomization.
Affected products
- Netty netty-resolver-dns <= 4.1.134.Final, >= 4.2.0.Final, <= 4.2.14.Final
Timeline
- 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
- 2026-06-05: advisory: GitHub Security Advisory GHSA-xmv7-r254-6q78 published
- 2026-06-12: disclosed: CVE-2026-45673 published to NVD