CVE-2026-73508
Received Received - Intake

Memory Leak in Netty DNS Handler

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73508
EUVD
EUVD-2026-58086

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
netty netty to 4.2.16.Final (exc)
netty netty_codec_dns to 4.1.136.Final (exc)
netty netty to 4.1.136_final (inc)
netty netty to 4.2.16_final (inc)
netty netty to 4.1.136.Final (exc)
netty netty 4.1.136.Final
netty netty 4.2.16.Final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-772 The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in Netty's DNS codec where malicious DNS packets with invalid domain names cause a gradual denial of service. When parsing malformed domain names, exceptions prevent proper cleanup of allocated ByteBuf objects, leading to resource exhaustion over time.

Detection Guidance

Detecting this vulnerability requires monitoring for memory leaks in Netty's DNS codec components. Check for gradual memory consumption increases in applications using Netty's DNS record decoder like DnsNameResolver. Use system monitoring tools such as top, htop, or ps to observe memory usage trends. For Java applications, enable JVM memory tracking with flags like -XX:+HeapDumpOnOutOfMemoryError and analyze heap dumps for ByteBuf leaks.

Impact Analysis

The vulnerability can cause system resource exhaustion due to memory leaks from sustained malicious DNS requests. This may lead to degraded performance, crashes, or denial of service in applications using Netty's DNS record decoder like DnsNameResolver or custom DNS servers.

Mitigation Strategies

Immediately upgrade Netty to version 4.1.136.Final or 4.2.16.Final or later. If upgrading is not possible, disable DNS record decoding in affected applications or implement strict input validation for DNS packets. Monitor network traffic for malformed DNS queries and block suspicious sources. Apply the patches from the official Netty releases to prevent memory leaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart