io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names

A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually...

Security Bulletin: IBM Storage Protect Server is affected by an improper domain name validation vulnerability (CVE-2026-42579).

Summary IBM Storage Protect Server uses the netty-codec-dns library in certain components. A vulnerability in netty could allow improper handling of domain names that do not comply with RFC 1035 constraints. An attacker can exploit this through malicious DNS responses or specially crafted...

RHLW-2026-02416B185203289C Lightwell Security Advisory: netty-codec-dns 4.1.132.Final-rhlw-00002

Red Hat Lightwell has released io.netty:netty-codec-dns 4.1.132.Final-rhlw-00002 with a backported security fix. CVE-2026-42579: Netty: DNS Codec Input Validation Bypass in Netty Encoder + Decoder This patched artifact is a drop-in replacement for io.netty:netty-codec-dns 4.1.132.Final from Maven...

RHLW-2026-69CA3F0D713E6636 Lightwell Security Advisory: netty-codec-dns 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-dns 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-42579 and CVE-2026-73508. CVE-2026-42579: Netty: DNS Codec Input Validation Bypass in Netty Encoder + Decoder CVE-2026-73508: Netty: Memory Leak in DNS Record Decoder via Malformed...

ROOT-APP-MAVEN-CVE-2026-42579 CVE-2026-42579 in io.netty:netty-codec-dns - Patched by Root

Root has patched CVE-2026-42579 in the io.netty:netty-codec-dns package for Root:Maven. Multiple fixed versions available...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names

A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually...

io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names

A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names

A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names

A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually...

RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.1.8 (RHSA-2026:70229)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70229 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release ...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.1.8 (RHSA-2026:70228)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70228 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release ...

io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names

A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +25421 more potentially affected by CVE-2026-73508 via io.netty:netty-codec-dns (>=4.1.0.beta4, <=4.1.135.final)

io.netty:netty-codec-dns MAVEN version =4.1.0.beta4, =0.0.1, =1.0.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves: CVE-2026-73508 Source...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through DnsCodecUtil.decompressDomainName in codec-dns/src/main/java/io/netty/handler/codec/dns/DnsCodecUtil.java. An attacker can exhaust direct memory and trigger a gradual denial o...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.covia:covia-sql (0.6.0) +4567 more potentially affected by unknown CVE via io.netty:netty-codec-dns (>=4.2.0.alpha1, <=4.2.15.final)

io.netty:netty-codec-dns MAVEN version =4.2.0.alpha1, =0.4.0, =0.4.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta, =0.6.4, =0.6.4, =0.6.4, =0.1.0, =1.8.1 and more Source cves: unknown CVE Source advisory: SNYK:JAVA-IONETTY-18313049...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +25421 more potentially affected by CVE-2026-73508 via io.netty:netty-codec-dns (>=4.1.0.beta4, <=4.1.135.final)

io.netty:netty-codec-dns MAVEN version =4.1.0.beta4, =0.0.1, =1.0.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves: CVE-2026-73508 Source...