netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement

🗓️ 10 Jun 2026 12:09:05Reported by RedHatType

Netty DNS codec fails to enforce domain name constraints per RFC 1035 in encoding and decoding.

Reporter	Title	Published	Views	Family All 133
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	16 Jun 202616:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	26 Jun 202606:15	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Netty, IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	11 Jun 202607:12	–	ibm
BDU FSTEC	The vulnerability in the `io.netty.handler.codec.dns.DnsCodecUtil` component of the Netty framework, which is used for developing network applications, servers, and clients, allows a attacker to cause a service failure.	30 Jun 202600:00	–	bdu_fstec
Chainguard	CVE-2026-42579 vulnerabilities	7 May 202619:17	–	cgr
Circl	CVE-2026-42579	5 May 202618:10	–	circl
CNNVD	Netty 输入验证错误漏洞	13 May 202600:00	–	cnnvd
Atlassian	Injection io.netty:netty-codec-dns Dependency in Confluence Data Center	2 Jun 202616:30	–	atlassian
CVE	CVE-2026-42579	13 May 202618:01	–	cve
Cvelist	CVE-2026-42579 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)	13 May 202618:01	–	cvelist

Vulners

Node

redhat quarkusRange<3.33el8

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-42579
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42579
cve	www.cve.org/CVERecord

09 Jul 2026 15:32Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.5 - 9.1

EPSS0.00969

SSVC