Netty is an asynchronous, event‑driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, its DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This lack of input validation allows malicious DNS responses to bypass validation, leading to crashes or denial of service, and permits user‑influenced hostnames to be sent unchecked by the encoder. The flaw stems from improper input validation (CWE‑20) and buffer handling weaknesses (CWE‑1286), creating a vulnerability that can exhaust resources or crash the application.

Any software that incorporates Netty 4.x and relies on the DNS codec before version 4.2.13.Final or 4.1.133.Final is vulnerable. This includes all deployments that use the netty:netty library without the mentioned version update.

The CVSS score of 7.5 indicates a high severity vulnerability. EPSS is <1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based; an attacker can craft DNS responses or supply hostnames that trigger improper handling. The weakness is classified as CWE‑20 and CWE‑1286, which together allow exploitation without local privileges or special conditions, making exploitation likely in exposed services.