The Erlang/OTP kernel’s built‑in resolver, inet_res, generates a sequential 16‑bit transaction ID for UDP DNS queries and does not randomize the source port. Because response validation relies almost entirely on this predictable ID, an attacker who can observe a single query or predict the next value can forge a DNS reply and poison the resolver’s cache, potentially redirecting traffic to malicious hosts.

Vendors and products affected are Erlang and Erlang:OTP. The flaw exists in OTP releases from 17.0 through 28.4.2 as well as 27.3.4.10 and 26.2.5.19, corresponding to kernel versions 3.0 through 10.6.2, 10.2.7.4, and 9.2.4.11. The resolver is intended for use in trusted network environments and with trusted recursive resolvers, but earlier documentation did not clearly state this assumption.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would need network access from which they can observe or predict the sequential query ID; no prerequisite authentication is required. Due to the sequential nature of the ID and lack of source port randomization, deliberate cache poisoning remains technically feasible in unshielded environments, but the risk is mitigated by network isolation and proper configuration.