Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-12T14:16:03 netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N CWE-1241

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

A flaw was found in Netty's DNS resolver component. This vulnerability arises from the use of a predictable pseudo-random number generator (PRNG) for DNS transaction IDs and a static User Datagram Protocol (UDP) source port. This combination significantly reduces the randomness of DNS queries, making it easier for a remote attacker to perform DNS Cache Poisoning, also known as a Kaminsky attack. Successful exploitation could allow an attacker to redirect network traffic to malicious servers.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat build of Quarkus 3.27.4.SP1 2026-06-17T00:00:00Z RHSA-2026:26018 netty-resolver-dns Red Hat build of Quarkus 3.33.2.SP1 2026-06-17T00:00:00Z RHSA-2026:26017 netty-resolver-dns Cryostat 4 Fix deferred netty-resolver-dns OpenShift Serverless Fix deferred openshift-serverless-1/kn-ekb-dispatcher-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-ekb-receiver-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9 Red Hat build of Apache Camel 4 for Quarkus 3 Fix deferred netty-resolver-dns Red Hat build of Apache Camel for Spring Boot 4 Fix deferred netty-resolver-dns Red Hat build of Apache Camel - HawtIO 4 Fix deferred netty-resolver-dns Red Hat build of Apicurio Registry 3 Fix deferred netty-resolver-dns Red Hat build of Debezium 3 Fix deferred netty-resolver-dns Red Hat Build of Keycloak Fix deferred netty-resolver-dns Red Hat Build of Keycloak Fix deferred rhbk/keycloak-rhel9 Red Hat Build of Keycloak Fix deferred rhbk/keycloak-rhel9-operator Red Hat Build of Keycloak Fix deferred rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Build of Keycloak Fix deferred rhbk-rhel9-operator/rhbk-rhel9-operator Red Hat Data Grid 8 Fix deferred netty-resolver-dns Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred bazel6 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred bazel7 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred bazel8 Red Hat Fuse 7 Fix deferred netty-resolver-dns Red Hat JBoss Enterprise Application Platform 7 Fix deferred netty-resolver-dns Red Hat JBoss Enterprise Application Platform 8 Fix deferred netty-resolver-dns Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred netty-resolver-dns Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/multicluster-redirector-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/pluginregistry-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/server-rhel9 Red Hat Single Sign-On 7 Fix deferred netty-resolver-dns streams for Apache Kafka 2 Fix deferred netty-resolver-dns streams for Apache Kafka 3 Fix deferred netty-resolver-dns https://www.cve.org/CVERecord?id=CVE-2026-45673 https://nvd.nist.gov/vuln/detail/CVE-2026-45673 https://github.com/netty/netty/releases/tag/netty-4.1.135.Final https://github.com/netty/netty/releases/tag/netty-4.2.15.Final https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78