Executive brief
Netty, a widely used networking framework for Java applications, contains a vulnerability in how it handles DNS (Domain Name System) messages. This flaw allows attackers to manipulate domain names to bypass security filters or poison DNS caches, and can also be used to crash applications by sending specially crafted network responses that exhaust system memory. Organizations using Netty for DNS resolution should update to the patched versions to prevent potential service outages or unauthorized redirection of network traffic.
Technical details
Netty's DNS codec in `DnsCodecUtil` fails to validate domain name constraints defined in RFC 1035 during both encoding and decoding. The encoder is vulnerable to null byte injection (CWE-626), allowing differential interpretation of domain names between Java and native libraries, which can lead to DNS cache poisoning. It also fails to enforce the 63-byte label limit and 255-byte total length limit, causing parser confusion where overlength labels are misinterpreted as compression pointers. The decoder lacks length checks and uses an unbounded StringBuilder, allowing a malicious DNS server to trigger excessive memory allocation (CWE-400) and potential Denial of Service. Patches are available in versions 4.1.133.Final and 4.2.13.Final.
Affected products
- Netty Project Netty >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final
Timeline
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-07: disclosed: Vulnerability disclosed as CVE-2026-42579