Skip to main content

Netty EUVDEUVD-2026-58086

| CVE-2026-73508 MEDIUM
Missing Release of Resource after Effective Lifetime (CWE-772)
2026-08-13 GitHub_M GHSA-mfg7-5gfp-c4w3
Denial Of Service Netty Suse Red Hat
5.3
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
5.3 MEDIUM

Network-reachable with no auth or complexity; impact is availability-only and limited because exhaustion is gradual, not immediate.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

4
Patch available
Aug 13, 2026 - 16:18 EUVD
Source Code Evidence Fetched
Aug 13, 2026 - 16:02 vuln.today
Analysis Generated
Aug 13, 2026 - 16:02 vuln.today
CVE Published
Aug 13, 2026 - 14:27 cve.org
MEDIUM 5.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 240 maven packages depend on io.netty:netty-codec-dns (3 direct, 237 indirect)

Ecosystem-wide dependent count for version 4.2.0.Final.

DescriptionCVE.org

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

AnalysisAI

Direct memory exhaustion in Netty's DNS codec (netty-codec-dns) allows unauthenticated remote attackers to trigger incremental off-heap memory leaks by sending DNS packets containing malformed domain names. When IDN.toASCII() or encodeDomainName() throws an IllegalArgumentException due to IDNA rule violations or embedded null bytes, ByteBuf objects allocated or retained during record decoding are never released - accumulating until the JVM's direct memory is exhausted, producing a gradual denial of service. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify Netty DNS codec endpoint
Delivery
Craft DNS packets with IDNA-invalid domain names
Exploit
Send sustained packet stream to decoder
Execution
ByteBuf objects leak per packet
Persist
Direct memory exhausts
Impact
Service crash or severe degradation
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target application must use Netty's DNS codec components - specifically DefaultDnsRecordDecoder, DnsNameResolver, or a custom DNS server built on Netty's netty-codec-dns module. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 Medium) accurately reflects the exploitation profile: fully unauthenticated, network-reachable, zero-complexity, with limited rather than complete availability impact because the DoS is gradual rather than immediate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker targeting a service that uses Netty's DnsNameResolver - such as a microservice performing outbound DNS lookups with Netty as its transport - sends a stream of crafted DNS response packets containing IDNA-invalid domain names or null-byte-embedded labels. Each malformed packet causes one or more ByteBuf objects to be allocated but never freed, incrementally consuming off-heap direct memory. …
Remediation Upgrade io.netty:netty-codec-dns to 4.1.136.Final (for 4.1.x users) or 4.2.16.Final (for 4.2.x users). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
CVE-2026-50011 HIGH POC
7.5 Jun 12

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
CVE-2022-41881 HIGH POC
7.5 Dec 12

Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner
CVE-2020-7238 HIGH POC
7.5 Jan 27

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Tr
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked

Same weakness CWE-772 – Missing Release of Resource after Effective Lifetime

View all
CVE-2017-14495 HIGH POC
7.5
CVE-2024-20481 MEDIUM
5.8
CVE-2017-14138 CRITICAL POC
9.8
CVE-2020-12134 CRITICAL POC
9.8
CVE-2018-19760 HIGH POC
8.8
CVE-2017-13748 HIGH POC
7.5
CVE-2017-15268 HIGH POC
7.5
CVE-2017-11655 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

Share

EUVD-2026-58086 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy