Is CVE-2026-42579 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42579 being exploited in the wild.

How severe is CVE-2026-42579?

High severity, with a CVSS score of 7.5, published 13 May 2026.

Which products and versions are affected?

io.netty:netty-codec-dns (Maven) ECOSYSTEM:introduced=4.2.0.Alpha1,fixed=4.2.13.Final.

Is there a fix for CVE-2026-42579?

Yes. io.netty:netty-codec-dns (Maven): upgrade to 4.2.13.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42579 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42579?

Check whether you run io.netty:netty-codec-dns (Maven), Netty Codec DNS or Netty Project Netty Codec DNS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42579: Netty DNS codec input validation bypass in DnsCodecUtil

CVE-2026-42579 · Severity: high · CVSS 7.5 · Published 2026-05-13

Netty, a widely used networking framework for Java applications, contains a vulnerability in how it handles DNS (Domain Name System) messages. This flaw allows attackers to manipulate domain names to bypass security filters or poison DNS caches, and can also be used to crash applications by sending specially crafted network responses that exhaust system memory. Organizations using Netty for DNS resolution should update to the patched versions to prevent potential service outages or unauthorized redirection of network traffic.

Vendors: Maven, Netty, Netty Project.

Quick answers

Is CVE-2026-42579 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42579 being exploited in the wild.
How severe is CVE-2026-42579?: High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?: io.netty:netty-codec-dns (Maven) ECOSYSTEM:introduced=4.2.0.Alpha1,fixed=4.2.13.Final.
Is there a fix for CVE-2026-42579?: Yes. io.netty:netty-codec-dns (Maven): upgrade to 4.2.13.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42579 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42579?: Check whether you run io.netty:netty-codec-dns (Maven), Netty Codec DNS or Netty Project Netty Codec DNS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

io.netty:netty-codec-dns (Maven): upgrade to 4.2.13.Final or later

# set io.netty:netty-codec-dns to 4.2.13.Final in your pom.xml or build.gradle

Technical details

Netty's DNS codec in `DnsCodecUtil` fails to validate domain name constraints defined in RFC 1035 during both encoding and decoding. The encoder is vulnerable to null byte injection (CWE-626), allowing differential interpretation of domain names between Java and native libraries, which can lead to DNS cache poisoning. It also fails to enforce the 63-byte label limit and 255-byte total length limit, causing parser confusion where overlength labels are misinterpreted as compression pointers. The decoder lacks length checks and uses an unbounded StringBuilder, allowing a malicious DNS server to trigger excessive memory allocation (CWE-400) and potential Denial of Service. Patches are available in versions 4.1.133.Final and 4.2.13.Final.

Affected products

Netty Project Netty >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final

Identifiers

CVE-2026-42579
GHSA-cm33-6792-r9fm

Timeline

2026-05-05: advisory: GitHub Advisory published
2026-05-07: disclosed: Vulnerability disclosed as CVE-2026-42579

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.