CVE-2026-42579 — Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

Description (CNA)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected (CNA)

Vendor / product	Versions
netty / netty	affected >= 4.2.0.Alpha1, < 4.2.13.Final; affected < 4.1.133.Final

CWE

CWE-20, CWE-400, CWE-626

References

https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm

redhat-SADP

A flaw was found in Netty. Netty's DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.