Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-73508 EUVD-2026-58086GHSA-mfg7-5gfp-c4w3

Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

Published Aug 13, 2026 · Updated Aug 13, 2026 · Assigned by GitHub_M

Vendor: netty Product: netty Package: akhq Package: apache-nifi Package: apache-pulsar-4.2 Package: apicurio-registry Package: celeborn-0.6 Package: druid Package: io.netty:netty-codec-dns Package: keycloak-26.5 Package: keycloak-26.5-iamguarded-compat Package: keycloak-26.5-operator Package: keycloak-26.6 Package: keycloak-26.6-iamguarded-compat Package: keycloak-26.6-operator Package: management-api-for-apache-cassandra-5.0 Package: netty Package: netty Package: opensearch-3-discovery-ec2 Package: opensearch-3-iamguarded-compat Package: opensearch-3-neural-search Package: opensearch-3-repository-azure Package: spark-4.0-scala-2.13 Package: spark-4.1-scala-2.13 Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: tez Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: zipkin Package: zipkin-slim Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected products

VendorProductAffectedFixed
netty netty < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 netty No fix yet —
Debian 13 netty No fix yet —
Debian 12 netty No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 netty No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS netty No fix yet —
Ubuntu Pro 24.04 LTS netty No fix yet —
Ubuntu Pro 22.04 LTS netty No fix yet —
Ubuntu Pro 20.04 LTS netty No fix yet —
Ubuntu Pro 18.04 LTS netty No fix yet —
Ubuntu Pro 16.04 LTS netty No fix yet —
Ubuntu Pro 14.04 LTS netty No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.40.0-8.redhat_00024.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.1.7-1.SP1_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-artemis-wildfly-integration 2.0.5-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.85.0-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-cryptacular 1.2.7-1.redhat_00002.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 801.8.0-1.GA_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-hibernate +2 6.6.54-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-httpcomponents-asyncclient 4.1.5-5.redhat_00008.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-ironjacamar +8 3.0.22-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jackson-core +12 2.18.9-1.redhat_00003.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jakarta-xml-bind-api 4.0.5-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jaxb +9 4.0.7-4.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jaxbintros 2.1.0-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jboss-logging 3.6.3-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jboss-remoting 5.0.31-1.SP2_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-api 3.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-common-tools 2.2.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.4.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-jaxws-undertow-httpspi 3.0.1-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-spi 5.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jsf-impl 4.0.11-2.SP1_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-log4j 2.25.4-1.redhat_00003.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-neethi 3.2.2-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-netty +14 4.1.136-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-nimbus-jose-jwt 9.37.4-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-parsson 1.1.9-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-saaj-impl +1 3.0.6-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.18-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-undertow 2.3.26-2.SP3_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly +3 8.1.8-9.GA_redhat_00006.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.6.11-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly-javadocs 8.1.1-12.GA_redhat_00048.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-ws-commons-XmlSchema 2.3.2-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.27.1-r14 —
Wolfi rolling apache-nifi 2.10.0-r9 —
Wolfi rolling apache-pulsar-4.2 4.2.3-r3 —
Wolfi rolling apicurio-registry 3.3.0-r12 —
Wolfi rolling celeborn-0.6 0.6.3-r13 —
Wolfi rolling druid 37.0.0-r47 —
Wolfi rolling keycloak-26.5 +2 No fix yet —
Wolfi rolling keycloak-26.6 +2 26.6.6-r0 —
Wolfi rolling management-api-for-apache-cassandra-5.0 0.1.122-r2 —
Wolfi rolling opensearch-3-discovery-ec2 +2 3.8.0-r3 —
Wolfi rolling opensearch-3-repository-azure 3.7.0-r5 —
Wolfi rolling spark-4.0-scala-2.13 4.0.4-r1 —
Wolfi rolling spark-4.1-scala-2.13 4.1.3-r2 —
Wolfi rolling strimzi-kafka-operator-kafka-init +6 1.1.0-r4 —
Wolfi rolling tez 0.10.5-r24 —
Wolfi rolling thingsboard-tb-node +1 4.3.1.3-r11 —
Wolfi rolling zipkin +1 3.6.1-r19 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.netty:netty-codec-dns >= 4.2.0.Final, < 4.2.16.Final 4.2.16.Final GHSA-mfg7-5gfp-c4w3
Maven io.netty:netty-codec-dns < 4.1.136.Final 4.1.136.Final GHSA-mfg7-5gfp-c4w3

Advisories 7

References