Generation of Predictable Numbers or Identifiers in Netty - CVE-2026-45673

Vulnerability identifier: #VU133451

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-45673

CWE-ID: CWE-340

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to poison the DNS cache.

The vulnerability exists due to generation of predictable numbers or identifiers in the Netty DNS resolver when generating DNS transaction IDs and using the default static UDP source port for DNS queries. A remote attacker can spoof DNS responses to poison the DNS cache.

Successful exploitation may cause downstream applications to connect to malicious IP addresses, enabling traffic interception or machine-in-the-middle attacks.

Netty
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Development Tools Module
SUSE Package Hub 15
Netezza Appliance
Maximo Application Suite - Monitor Component
webMethods developer portal
webMethods ControlPlane
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
IBM SPSS Analytic Server
IBM Sterling Connect:Direct Web Services
netty-tcnative
netty-tcnative-debugsource
netty-javadoc
netty

Install security update from vendor's website.

Netty - addressed in versions 4.1.135, 4.2.15
Netezza Appliance - update to 1.0.2.0
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.20, 6.4.0.9
Maximo Application Suite - Monitor Component - addressed in versions 9.0.23, 9.1.13, 9.2.1
webMethods developer portal - update to 11.1 Fix14
webMethods ControlPlane - update to 11.1 Fix11
netty-tcnative - update to 2.0.79-150200.3.45.1
netty-tcnative-debugsource - update to 2.0.79-150200.3.45.1
netty-javadoc - update to 4.1.135-150200.4.50.1
netty - update to 4.1.135-150200.4.50.1
watsonx Assistant Cartridge - update to 5.4.2
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.4.2

• https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78

• Multiple vulnerabilities in Netty
• Multiple vulnerabilities in IBM SPSS Analytic Server
• SUSE update for netty, netty-tcnative
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM webMethods API Management
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge