CVE-2026-45673: Netty DNS resolver DNS cache poisoning via predictable PRNG

CVE-2026-45673 · Severity: medium · CVSS 6.8 · Published 2026-06-12

Netty is a widely used networking framework that helps Java applications communicate over the internet. A security flaw in its DNS component makes it easier for attackers to redirect network traffic to malicious servers by guessing the identifiers used in web lookups. This could allow an attacker to intercept sensitive data or impersonate legitimate services without the user's knowledge.

Technologies: io.netty:netty-resolver-dns (Maven), Netty Project Resolver DNS. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-45673 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45673 being exploited in the wild.
How severe is CVE-2026-45673?
Medium severity, with a CVSS score of 6.8, published 12 June 2026.
Which products and versions are affected?
io.netty:netty-resolver-dns (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final; Netty Project Resolver DNS <= 4.1.134.Final, >= 4.2.0.Final, <= 4.2.14.Final.
Is there a fix for CVE-2026-45673?
Yes. io.netty:netty-resolver-dns (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45673 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45673?
Check whether you run io.netty:netty-resolver-dns (Maven) or Netty Project Resolver DNS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-resolver-dns (Maven): upgrade to 4.2.15.Final or later
    # set io.netty:netty-resolver-dns to 4.2.15.Final in your pom.xml or build.gradle

Technical details

The vulnerability exists in the io.netty.resolver.dns component. It stems from two primary issues: the use of a predictable PRNG (ThreadLocalRandom) for generating 16-bit DNS transaction IDs and a default configuration (ChannelPerResolver) that uses a static UDP source port. This lack of entropy allows a remote attacker to predict query identifiers and perform DNS cache poisoning. An exploit could lead to traffic redirection or Man-in-the-Middle (MitM) attacks. The issue is resolved in versions 4.1.135.Final and 4.2.15.Final by ensuring query IDs are non-predictable and improving port randomization.

Affected products

  • Netty netty-resolver-dns <= 4.1.134.Final, >= 4.2.0.Final, <= 4.2.14.Final

Identifiers

  • CVE-2026-45673
  • GHSA-xmv7-r254-6q78

Timeline

  • 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
  • 2026-06-05: advisory: GitHub Security Advisory GHSA-xmv7-r254-6q78 published
  • 2026-06-12: disclosed: CVE-2026-45673 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.