Netty CVE-2026-73508

Exploitable only when the target application uses Netty's DNS codec - specifically DefaultDnsRecordDecoder / DnsRecordDecoder as used by DnsNameResolver or a custom Netty-based DNS server - and processes attacker-supplied or attacker-influenced DNS packets containing malformed domain names (IDNA-invalid characters, or a null byte in a decompressed name). No authentication or user interaction is required (PR:N/UI:N). The main limiting factor is that impact is incremental: a single packet leaks only a small ByteBuf, so a sustained stream of malicious packets is needed to exhaust direct memory and cause denial of service; applications not deploying the DNS codec are unaffected.

This is a genuine but moderate-priority availability issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) is internally consistent with the description: unauthenticated remote attackers send malformed DNS packets that incrementally leak direct memory (CWE-772) until denial of service. All signals point to DoS-only impact - no confidentiality or integrity effect. Corroborating signals temper the raw score: EPSS is low at 0.33% (26th percentile), CISA SSVC records Exploitation=none and Technical Impact=partial (consistent with a gradual resource-exhaustion DoS rather than a total outage), and there is no KEV listing and no public exploit code. SSVC Automatable=yes reflects that packet-flooding is trivially scriptable, which is the main aggravating factor. The key limiter absent from the CVSS score is that impact only materializes when the target application actually uses Netty's DNS codec (DnsRecordDecoder, e.g. DnsNameResolver or a custom DNS server) and parses attacker-influenced DNS traffic - the 7.5 assumes that codec is in the data path. Net: a real, patch-worthy A:H bug for DNS-facing Netty deployments, but not an urgent widespread-exploitation event.

An attacker repeatedly sends crafted DNS packets containing domain names that violate IDNA rules (or contain a null byte after decompression) to a service that decodes DNS records with Netty. Each rejected name triggers an IllegalArgumentException inside AbstractDnsRecord's constructor / encodeDomainName() before the retained or newly allocated ByteBuf is assigned for release, leaking direct memory per packet until the JVM's direct-memory pool is exhausted and the service crashes or stops responding. No proof-of-concept exploit is published - the advisory provides only root-cause source analysis.