Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Published: 2026-08-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Netty, an asynchronous network framework, contains a memory leak (CWE‑772) in its DNS record decoder. The bug occurs when malformed domain names cause the decoder to reject input without releasing the associated ByteBuf objects, leading to incremental memory growth. An attacker can trigger the leak by sending crafted DNS packets to an affected instance, eventually exhausting available memory and causing a denial of service.

Affected Systems

The flaw exists in Netty versions older than 4.1.136.Final and 4.2.16.Final. Any application that incorporates Netty and processes DNS traffic in these versions is affected.

Risk and Exploitability

The vulnerability has a CVSS score of 5.3, indicating moderate severity, and currently has no EPSS data or KEV listing. Because it can be triggered by unauthenticated remote DNS packets, the attack surface is broadly reachable. An attacker needs only network access to send the malicious payload; no additional privileges are required. The impact is limited to memory exhaustion but can destabilize or crash the host, potentially leading to service downtime.

Generated by OpenCVE AI on August 13, 2026 at 17:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Netty to version 4.1.136.Final or later 4.2.16.Final.
  • If an upgrade is not immediately possible, block or heavily rate‑limit inbound DNS traffic that originates from untrusted sources using firewall or proxy rules.
  • In legacy deployments, implement application‑level monitoring to detect abnormal ByteBuf retention and enforce memory usage limits.
  • Apply general best‑practice input validation for domain names and ensure that all resources are released in error paths to mitigate similar resource‑leak weaknesses.

Generated by OpenCVE AI on August 13, 2026 at 17:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-mfg7-5gfp-c4w3 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
History

Wed, 19 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Sat, 15 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Netty
Netty netty
Vendors & Products Netty
Netty netty

Thu, 13 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Title Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
Weaknesses CWE-772
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Netty Netty
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-13T17:52:58.403Z

Reserved: 2026-08-12T19:00:33.736Z

Link: CVE-2026-73508

cve-icon Vulnrichment

Updated: 2026-08-13T17:49:10.482Z

cve-icon NVD

Status : Received

Published: 2026-08-13T15:20:17.463

Modified: 2026-08-13T18:18:17.977

Link: CVE-2026-73508

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-13T14:27:20Z

Links: CVE-2026-73508 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T20:15:03Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime