Netty’s DNS resolver uses a predictable pseudo‑random number generator to create transaction IDs and, by default, binds DNS queries to a static UDP source port. The low entropy of the transaction ID combined with the static source port greatly increases the feasibility of a Kaminsky‑style cache poisoning attack, allowing an attacker who can observe or influence DNS responses to inject forged records into the DNS cache of any application using Netty.

The vulnerability affects the Netty framework for Java prior to version 4.1.135.Final and 4.2.15.Final. Any application or service that relies on these libraries and performs DNS resolution over UDP is at risk.

The CVSS score of 6.8 places the vulnerability in the medium severity range, while the EPSS score of less than 1% indicates that exploitation is currently rare and not widely reported. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly documented exploits exist. Based on the description, the likely attack vector involves an attacker capable of observing or injecting DNS responses to send forged replies to the Netty DNS resolver, thereby poisoning the resolver’s cache.