logo

Database

Improper resource allocation In netty

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2026-735082. NVD-2026-735083. OSV-2026-735084. OSV-DEBIAN-2026-735085. GHSA-mfg7-5gfp-c4w36. GCVE-2026-735087. SECURITY-TRACKER-CVE-2026-73508

References

1. https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w32. https://github.com/netty/netty/pull/170633. https://github.com/netty/netty/pull/170654. https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b5. https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c66. https://github.com/netty/netty/releases/tag/netty-4.1.136.Final7. https://github.com/netty/netty/releases/tag/netty-4.2.16.Final

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.