https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:23:18.297599+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-15472 bdu:2026-15472 2026-10-03T10:23:18.430995+00:00 bdu:2026-15472 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 certfr-2026-avi-0933 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T10:23:18.431045+00:00 certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/cleanstart-2026-bk55944 Withdrawn: CLEANSTART-2026-BK55944 — Security fixes for CVE-2025-59250, CVE-2026-0636, CVE-2026-33870, CVE-2026-33871, CVE-2026-39852, CVE-2026-41417, CVE-2… 2026-10-03T10:23:18.431074+00:00

Withdrawn by the publisher.

Affected: CleanStart: keycloak

Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-326906 EUVD-2026-326906 2026-10-03T10:23:18.431138+00:00 EUVD-2026-326906 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45673 fkie_cve-2026-45673 2026-10-03T10:23:18.431159+00:00

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

 https://cve.radiocsirt.org/vuln/ghsa-xmv7-r254-6q78 GHSA-xmv7-r254-6q78 — Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port 2026-10-03T10:23:18.431199+00:00

Affected: Maven: io.netty:netty-resolver-dns

### Summary Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack).

### Details Two factors contribute to this vulnerability in io.netty.resolver.dns: - Predictable Query IDs: `DnsQueryIdSpace` manages 16-bit transaction IDs in buckets of 16,384 IDs. It initializes only the first bucket. When an ID is returned, it is pushed back into the bucket at a random index generated by java.util.concurrent.ThreadLocalRandom:

```java Random random = ThreadLocalRandom.current(); int insertionPosition = random.nextInt(count + 1); ```

Because ThreadLocalRandom is a predictable LCG and the resolver operates within a single bucket, the sequence of IDs is predictable once the PRNG state is mathematically recovered.

- Default Static Source Port: `DnsNameResolverBuilder` defaults to a `channelStrategy` of `ChannelPerResolver`. This binds the DatagramChannel once, resulting in a static source port for all subsequent queries.

Combined, a static source port and predictable transaction IDs reduces the entropy required to secure DNS resolution against spoofing.

### Impact DNS Cache Poisoning. Downstream applications using the default Netty DNS resolver may connect to malicious IPs, leading to traffic interception or MitM attacks.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11033-1 openSUSE-SU-2026:11033-1 — netty-4.1.135-1.1 on GA media 2026-10-03T10:23:18.431286+00:00

netty-4.1.135-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:26017 RHSA-2026:26017 — Red Hat Security Advisory: Red Hat build of Quarkus 3.33.2.SP1 security update 2026-10-03T10:23:18.431317+00:00

eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45673 UBUNTU-CVE-2026-45673 2026-10-03T10:23:18.431360+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:25.10: netty, Ubuntu:Pro:26.04:LTS: netty

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1814 WID-SEC-W-2026-1814 — Netty: Mehrere Schwachstellen 2026-10-03T10:23:18.431394+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.