Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.
References
| Link | Resource |
|---|---|
| https://github.com/netty/netty/releases/tag/netty-4.1.135.Final | Release Notes |
| https://github.com/netty/netty/releases/tag/netty-4.2.15.Final | Release Notes |
| https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Jun 2026, 02:14
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Netty netty
Netty |
|
| References | () https://github.com/netty/netty/releases/tag/netty-4.1.135.Final - Release Notes | |
| References | () https://github.com/netty/netty/releases/tag/netty-4.2.15.Final - Release Notes | |
| References | () https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78 - Vendor Advisory | |
| CPE | cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* |
12 Jun 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-12 15:16
Updated : 2026-06-15 02:14
NVD link : CVE-2026-45673
Mitre link : CVE-2026-45673
CVE.ORG link : CVE-2026-45673
JSON object : View
Products Affected
netty
- netty