VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Aug 13, 2026· Updated Sep 23, 2026

CVE-2026-73508

CVE-2026-73508

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.netty:netty-codec-dnsMaven
>= 4.2.0.Final, < 4.2.16.Final4.2.16.Final
io.netty:netty-codec-dnsMaven
< 4.1.136.Final4.1.136.Final

Affected products

146

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.