GHSA-xmv7-r254-6q78

Dashboard / Vulnerabilities / GHSA-xmv7-r254-6q78

GHSA-xmv7-r254-6q78

Summary: Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

Details: ### Summary Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). ### Details Two factors contribute to this vulnerability in io.netty.resolver.dns: - Predictable Query IDs: `DnsQueryIdSpace` manages 16-bit transaction IDs in buckets of 16,384 IDs. It initializes only the first bucket. When an ID is returned, it is pushed back into the bucket at a random index generated by java.util.concurrent.ThreadLocalRandom: ```java Random random = ThreadLocalRandom.current(); int insertionPosition = random.nextInt(count + 1); ``` Because ThreadLocalRandom is a predictable LCG and the resolver operates within a single bucket, the sequence of IDs is predictable once the PRNG state is mathematically recovered. - Default Static Source Port: `DnsNameResolverBuilder` defaults to a `channelStrategy` of `ChannelPerResolver`. This binds the DatagramChannel once, resulting in a static source port for all subsequent queries. Combined, a static source port and predictable transaction IDs reduces the entropy required to secure DNS resolution against spoofing. ### Impact DNS Cache Poisoning. Downstream applications using the default Netty DNS resolver may connect to malicious IPs, leading to traffic interception or MitM attacks.

References: https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78, https://nvd.nist.gov/vuln/detail/CVE-2026-45673, https://github.com/netty/netty, https://github.com/netty/netty/releases/tag/netty-4.1.135.Final, https://github.com/netty/netty/releases/tag/netty-4.2.15.Final