CVE-2026-73508: Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:nettyto a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
io.netty:nettyto a version that resolves this vulnerability.Fixed in 4.2.16.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73508?
CVE-2026-73508 has a medium severity rating of 5.3.
How do I fix CVE-2026-73508?
To fix CVE-2026-73508, upgrade to Netty version 4.1.136.Final or 4.2.16.Final or later.
What causes CVE-2026-73508?
CVE-2026-73508 is caused by a memory leak in the DNS Record Decoder from malformed domain names in certain versions of Netty.
Which versions of Netty are affected by CVE-2026-73508?
CVE-2026-73508 affects Netty versions before 4.1.136.Final and 4.2.16.Final.
What is the potential impact of CVE-2026-73508?
The potential impact of CVE-2026-73508 is a memory leak which may lead to resource exhaustion.