VDB
CVE-2026-73508
CVE-2026-73508
PUBLISHED
CVSS 5.3 MEDIUM
Reported by GitHub_M · Published August 13, 2026
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Risk Scores
CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| netty | netty | < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final |
| chainguard | apache-pulsar-4.1 | 0, 0, 0 |
| chainguard | opensearch-2 | 0, 0, 0 |
| chainguard | kayenta-2026.0 | 0, 0, 0 |
| chainguard | request-9047-keycloak-fips-26.6 | 0, 0, 0 |
| wolfi | tez | 0, 0, 0 |
| chainguard | celeborn-0.6 | 0, 0, 0 |
| chainguard | keycloak-fips-26.7 | 0, 0, 0 |
| wolfi | sonarqube | *, *, * |
| chainguard | elasticsearch-fips-8.19 | 0, 0, 0 |
| chainguard | camunda-8.8 | 0, 0, 0 |
| chainguard | camunda-zeebe-8.7 | 0, 0, 0 |
| chainguard | apache-pulsar-fips-4.0 | 0, 0, 0 |
| chainguard | keycloak-fips-26.6 | 0, 0, 0 |
| wolfi | druid | 0, 0, 0 |
| chainguard | thingsboard | 0, 0, 0 |
| chainguard | camunda-8.9 | 0, 0, 0 |
| chainguard | hono | 0, 0, 0 |
| chainguard | elasticsearch-fips-9.4 | 0, 0 |
| wolfi | keycloak-26.6 | 0, 0, 0 |
…and 78 more
Timeline
- Jul 24, 2026 CVE Published
- Aug 14, 2026 Coalition ESS Score
- Aug 14, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 4, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 9, 2026 CVE Updated
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
References
- https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3 x_refsource_CONFIRM
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b x_refsource_MISC
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final x_refsource_MISC