CoreCVE
Back

CRITICAL

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

Published May 13, 2026

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected products

Remediation

Red Hat statement

This is an Important integrity flaw in Netty's DNS codec. The vulnerability arises from insufficient enforcement of RFC 1035 domain name constraints during both encoding and decoding, allowing remote attackers to manipulate DNS responses or user-controlled hostnames. This could lead to a high integrity impact on affected Red Hat products that utilize the vulnerable Netty DNS codec.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Metrics

Weaknesses (4)

CWE-1286

CWE-20

Improper Input Validation

CWE-400

Uncontrolled Resource Consumption

CWE-626

References (22)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published May 13, 2026
Updated Sep 18, 2026
Reserved Apr 28, 2026
Link CVE-2026-42579
CISA Vulnrichment
Updated May 18, 2026
NVD
Status Modified
Modified Sep 18, 2026
Link CVE-2026-42579
Red Hat
Severity Important
Public date May 13, 2026
Links CVE-2026-42579 - Bugzilla
GHSA-CM33-6792-R9FM