Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-42579

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

netty netty

  • >= 4.2.0.Alpha1, < 4.2.13.Finalaffected
  • < 4.1.133.Finalaffected

References