CVE-2026-42579: netty Improper Input Validation

Vulnerability summary

CVE-2026-42579 is a critical (CVSS 9.1) Improper Input Validation vulnerability in netty. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-05-2026
   PublishedVulnerability first disclosed.
2. 18-09-2026
   Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-626Null Byte Interaction Error (Poison Null Byte)The product does not properly handle null bytes or NUL characters when passing data between different representations or components.
• CWE-1286Improper Validation of Syntactic Correctness of InputThe product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.