CVE-2026-45673: Netty DNS Cache Poisoning Vulnerability (Kaminsky Attack)

Technical summary

The vulnerability arises from insufficient entropy in Netty's DNS query generation. Specifically, the DNS resolver employs a predictable pseudorandom number generator (PRNG) for transaction ID creation (CWE-330: Use of Insufficiently Random Values), combined with a static UDP source port assignment. In the DNS protocol, transaction IDs and source ports serve as identifiers that make it difficult for an attacker to forge valid responses. When an attacker can predict or brute-force these values, they can inject forged DNS responses into the resolver's cache before the legitimate answer arrives. The CVSS 3.1 score of 6.8 reflects the network-based attack vector, the relatively high complexity needed to successfully execute the attack, and the integrity impact—poisoned DNS records can redirect traffic or facilitate phishing campaigns without affecting availability or requiring user interaction.

Business impact

DNS resolution is fundamental to nearly all network communication. Applications using vulnerable Netty versions for DNS lookups become susceptible to cache poisoning attacks that could redirect users to attacker-controlled servers. The practical impact depends on how the application uses DNS: a microservices architecture relying on service discovery could have inter-service traffic redirected; a client application could have its connections diverted to phishing or malware sites. While the attack requires some sophistication (the AC:H rating reflects this), successful exploitation can compromise the integrity of network traffic at scale, affecting user trust and potentially enabling credential theft, malware distribution, or data exfiltration.

Affected systems

Netty versions prior to 4.1.135.Final (on the 4.1.x line) and prior to 4.2.15.Final (on the 4.2.x line) are affected. This includes all 4.0.x versions and earlier. Any Java application or service that embeds Netty and uses its DNS resolver component is at risk. Common use cases include Spring Cloud applications, message brokers, API gateways, and microservices that perform DNS lookups internally. The impact is highest in environments where DNS results directly influence traffic routing or authentication decisions.

Exploitability

Exploitation requires network access to intercept or predict DNS queries and inject forged responses. The CVSS AC:H (Attack Complexity: High) rating acknowledges that successful exploitation demands careful timing and knowledge of the target's DNS query patterns. An attacker must typically be on the same network segment or have the ability to manipulate network traffic (e.g., via BGP hijacking, ARP spoofing, or compromised network infrastructure). The predictable PRNG and static source port significantly lower the barrier compared to a properly randomized DNS resolver, but the attack is not trivial. Once successful, however, the attacker gains the ability to persistently poison cached entries, creating a sustained integrity breach.

Remediation

Upgrade to Netty 4.1.135.Final or later on the 4.1.x branch, or 4.2.15.Final or later on the 4.2.x branch. These versions implement a cryptographically secure random number generator for transaction IDs and randomize the UDP source port for each query, substantially increasing entropy and making the attack infeasible. No configuration changes are required post-upgrade. Organizations should prioritize patching in environments where Netty is used for DNS resolution, especially in microservices and cloud-native architectures where DNS is relied upon for service discovery.

Patch guidance

Apply vendor patches immediately via your standard dependency management process. For Maven projects, update the netty-all or netty-dns artifact to version 4.1.135.Final or 4.2.15.Final (or later). For Gradle, update build.gradle accordingly. Test the patched version in a non-production environment first to ensure compatibility—Netty patches are generally backward-compatible, but verification is prudent. If you maintain custom DNS resolver code on top of Netty, review it to ensure it does not re-introduce predictable sources of entropy. Check your application's artifact supply chain to confirm no intermediate dependencies are pinning an older Netty version, which could prevent the patch from being applied.

Detection guidance

Monitor for vulnerable Netty versions in your codebase using software composition analysis (SCA) tools configured to flag versions prior to 4.1.135.Final and 4.2.15.Final. At runtime, DNS-focused network monitoring and DNS query-response correlation can help identify anomalies: look for patterns of mismatched DNS responses (unexpected TTLs, IP addresses that diverge from baselines, or responses arriving before legitimate answers). If your environment permits, enable DNS query logging at your resolver or proxy layer and correlate with Netty application logs. In high-security environments, consider deploying DNSSEC validation to cryptographically verify DNS responses, which would prevent successful cache poisoning regardless of transaction ID or source port predictability.

Why prioritize this

This vulnerability merits prompt attention because DNS is a critical infrastructure component and Netty is prevalent in Java microservices and cloud deployments. Although the attack complexity is rated as high, the combination of predictable entropy sources meaningfully lowers the practical bar for attackers with network access or on shared infrastructure (e.g., cloud multi-tenant environments). The integrity impact of successful poisoning can cascade: a single compromised DNS entry can redirect traffic for all dependent services. The lack of KEV listing does not diminish the importance of patching, as exploitation remains feasible in targeted scenarios. Organizations should treat this as a moderate-priority patch, prioritizing systems in security-sensitive architectures and those exposed to untrusted networks.

Risk score, explained

The CVSS 3.1 base score of 6.8 (MEDIUM) reflects a network-accessible vulnerability (AV:N) with high attack complexity (AC:H), no privilege requirement (PR:N), no user interaction (UI:N), and a scope change (S:C)—meaning the vulnerability can affect resources beyond the vulnerable component. The integrity impact is high (I:H) because poisoned DNS records undermine the authenticity of network routing, while confidentiality and availability are unaffected. The AC:H rating acknowledges the need for precise timing and network position; however, the predictable PRNG and static port substantially reduce attack complexity compared to a properly implemented DNS resolver. Environmental factors (e.g., network isolation, DNSSEC validation) can lower risk in some deployments.

Frequently asked questions