By weakness (CWE)

CWE-340: related vulnerabilities

CVEs classified under CWE-340. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

2 published vulnerabilities

• CVE-2026-45673MEDIUM 6.8

  Netty, a widely-used Java framework for building network applications, has a DNS resolver flaw that makes it easier for attackers to poison DNS caches. The issue stems from two weaknesses: the framework generates DNS request IDs using a predictable random number generator, and it sends all DNS queries from the same UDP port by default. Together, these reduce the unpredictability of DNS traffic, making it feasible for an attacker to craft malicious DNS responses that get cached and served to users—a technique known as DNS Cache Poisoning or a Kaminsky attack. Patched versions 4.1.135.Final and 4.2.15.Final address both issues.

• CVE-2026-42932MEDIUM 5.3

  Naxclow devices use predictable device identifiers that are generated using fixed manufacturing prefixes and simple sequential counters. This design flaw allows an attacker to easily predict or enumerate which devices exist on a network without authentication. Additionally, the platform exposes a publicly accessible endpoint that reveals the highest device identifier currently in use, making it trivial to determine the size and composition of an active Naxclow fleet.