CVE-2026-73508

MediumCVSS 5.3

Published: 13/08/2026(UTC)Updated: 13/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

Netty before versions 4.1.136.Final and 4.2.16.Final failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name. Remote DNS packets can leak direct memory incrementally until denial of service.

Risk Assessment

An attacker can send malicious DNS packets, causing memory exhaustion and service unavailability.

Recommendation

Update Netty to version 4.1.136.Final or 4.2.16.Final or later.

Original NVD description (English source)

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.