io.netty:netty-resolver-dns 4.2.9.Final

Direct Vulnerabilities

Known vulnerabilities in the io.netty:netty-resolver-dns package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Insufficient Verification of Data Authenticity Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to missing validation of the origin of CNAME records in DNS responses within the `DnsResolveContext` function. An attacker can inject unauthorized DNS records by supplying malicious DNS responses, potentially leading to cache poisoning and redirection of network traffic. How to fix Insufficient Verification of Data Authenticity? Upgrade `io.netty:netty-resolver-dns` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)
M Generation of Predictable Numbers or Identifiers Affected versions of this package are vulnerable to Generation of Predictable Numbers or Identifiers due to the use of a predictable pseudo-random number generator for DNS transaction IDs and a default static UDP source port in the DNS resolution process. An attacker can redirect network traffic or perform man-in-the-middle attacks by spoofing DNS responses. Note: This is only exploitable if the attacker's forged response arrives before the legitimate DNS reply. The timing window is not guaranteed. How to fix Generation of Predictable Numbers or Identifiers? Upgrade `io.netty:netty-resolver-dns` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)
H Insufficient Verification of Data Authenticity Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the `DnsResolveContext.AuthoritativeNameServerList#add` function. An attacker can inject malicious NS and A records into the DNS cache by controlling an authoritative name server for a subdomain and providing NS records that claim authority over a parent domain, leading to unauthorized redirection or interception of DNS queries for affected domains. How to fix Insufficient Verification of Data Authenticity? Upgrade `io.netty:netty-resolver-dns` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

Vulnerability

Vulnerable Version

Insufficient Verification of Data Authenticity

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to missing validation of the origin of CNAME records in DNS responses within the DnsResolveContext function. An attacker can inject unauthorized DNS records by supplying malicious DNS responses, potentially leading to cache poisoning and redirection of network traffic.

How to fix Insufficient Verification of Data Authenticity?

Upgrade io.netty:netty-resolver-dns to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

Generation of Predictable Numbers or Identifiers

Affected versions of this package are vulnerable to Generation of Predictable Numbers or Identifiers due to the use of a predictable pseudo-random number generator for DNS transaction IDs and a default static UDP source port in the DNS resolution process. An attacker can redirect network traffic or perform man-in-the-middle attacks by spoofing DNS responses.

Note:

This is only exploitable if the attacker's forged response arrives before the legitimate DNS reply. The timing window is not guaranteed.

How to fix Generation of Predictable Numbers or Identifiers?

Upgrade io.netty:netty-resolver-dns to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

Insufficient Verification of Data Authenticity

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the DnsResolveContext.AuthoritativeNameServerList#add function. An attacker can inject malicious NS and A records into the DNS cache by controlling an authoritative name server for a subdomain and providing NS records that claim authority over a parent domain, leading to unauthorized redirection or interception of DNS queries for affected domains.

How to fix Insufficient Verification of Data Authenticity?

Upgrade io.netty:netty-resolver-dns to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

io.netty:netty-resolver-dns@4.2.9.Final

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically