CVE-2026-42579 Details
Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
A vulnerability exists in Netty's DNS codec, specifically in versions prior to 4.2.13.Final and 4.1.133.Final. The issue arises because the codec does not properly validate domain names according to RFC 1035 during encoding and decoding processes. This lack of validation creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, while user-influenced hostnames can exploit the encoder. On the encoder side, the vulnerability allows null byte injection, acceptance of overly long labels, and silent truncation of domain names. On the decoder side, it enables unbounded memory allocation from oversized labels, potentially leading to denial-of-service conditions.
Users can upgrade to Netty versions 4.2.13.Final or 4.1.133.Final, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | redhat-SADP |
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-626 | Null Byte Interaction Error (Poison Null Byte) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netty netty | < 4.1.133 >= 4.2.0, < 4.2.13 |
CPE
Remediation
| |
Change History
19 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | redhat-SADP |
| Sep 17, 2026 | CVE Modified | redhat-SADP |
| Sep 9, 2026 | CVE Modified | redhat-SADP |
| Sep 7, 2026 | CVE Modified | redhat-SADP |
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | CVE Modified | redhat-SADP |
| Sep 2, 2026 | CVE Modified | [email protected] |
| Aug 21, 2026 | CVE Modified | redhat-SADP |
| Aug 13, 2026 | CVE Modified | redhat-SADP |
| Aug 12, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 9, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 18, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |