What’s Vulnerable › Vulnerabilities

CVE-2026-73508: Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-13 · updated 2026-09-23
• Weakness: CWE-772

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected products

• netty: before 4.1.136; from 4.2.0 before 4.2.16 — fixed in 4.1.136, 4.2.16

How to fix

Upgrade to a fixed version: netty 4.1.136, 4.2.16. Check the vendor advisory for mitigations.

References

• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
• https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3

Get alerted when CVE-2026-73508 or the next vulnerability affects your stack