CVE-2026-73508: netty

CVSS: 7.5v3.1HighAnalyzed

AliasesUBUNTU-CVE-2026-73508DEBIAN-CVE-2026-73508CGA-23hj-626w-4pq8+490 more

Published 13-08-2026Last modified 13-08-2026

Vulnerability summary

CVE-2026-73508 is a high (CVSS 7.5) vulnerability in netty. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.6% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

0.38%

0%100%

Low · +0.05 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1

RHSA-2026:70228 RHSA-2026:70229 RHSA-2026:70230 CGA-M9G6-2M56-H573

Timeline

13-08-2026
PublishedVulnerability first disclosed.
13-08-2026
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.38%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

+0.05 pp

From 0.33% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.38%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-772Missing Release of Resource after Effective LifetimeThe product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Affected systems

Chainguard166 products

airbyte-server< 2.0.0-r8
airbyte-server-fips< 2.0.0-r10
akhq< 0.27.1-r14
apache-hop< 2.18.1-r14
apache-hop-fips< 2.18.1-r6

apache-nifi< 2.10.0-r9
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.3-r3
apache-pulsar-fips-4.0< 4.0.12-r2
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-pulsar-fips-4.2< 4.2.3-r2
apicurio-registry< 3.3.0-r12
apicurio-registry-3-operator< 3.3.0-r12
apicurio-registry-3-operator-fips< 3.3.0-r9
apicurio-registry-fips< 3.3.0-r9
camunda-8.8< 8.8.31-r2
camunda-8.9< 8.9.13-r2
camunda-zeebe-8.6< 8.6.39-r6
camunda-zeebe-8.7< 8.7.35-r1
camunda-zeebe-8.8< 8.8.32-r1
camunda-zeebe-8.9< 8.9.13-r1
celeborn-0.5< 0.5.4-r32 | All versions (No fix recorded)
celeborn-0.6< 0.6.3-r13 | All versions (No fix recorded)
celeborn-0.7< 0.7.0-r3 | < 0.7.0-r9
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.22-r0
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
commercial-elasticsearch-9.4< 9.4.8-r0
commercial-elasticsearch-9.5< 9.5.5-r0
conductor< 3.31.0-r5
conductor-fips< 3.31.0-r6
druid< 37.0.0-r47 | < 37.0.0-r56
elasticsearch-8.19< 8.19.19-r1
elasticsearch-8.19-iamguarded< 8.19.19-r1
elasticsearch-8.19-iamguarded-fips< 8.19.19-r1
elasticsearch-9.1All versions (No fix recorded)
elasticsearch-9.1-iamguardedAll versions (No fix recorded)
elasticsearch-9.1-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.2All versions (No fix recorded)
elasticsearch-9.2-iamguarded< 9.2.8-r13
elasticsearch-9.2-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.3All versions (No fix recorded)
elasticsearch-9.3-iamguarded< 9.3.8-r6
elasticsearch-9.3-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.4< 9.4.5-r4
elasticsearch-9.4-iamguarded< 9.4.5-r3
elasticsearch-9.4-iamguarded-fips< 9.4.5-r5
elasticsearch-9.5< 9.5.2-r3
elasticsearch-9.5-iamguarded< 9.5.2-r3
elasticsearch-9.5-iamguarded-fips< 9.5.2-r3
elasticsearch-fips-8.19< 8.19.19-r1
elasticsearch-fips-9.1All versions (No fix recorded)
elasticsearch-fips-9.2All versions (No fix recorded)
elasticsearch-fips-9.3All versions (No fix recorded)
elasticsearch-fips-9.4< 9.4.5-r5
elasticsearch-fips-9.5< 9.5.2-r3
floci< 1.5.33-r4
gremlin-server< 3.8.1-r2
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r3 | All versions (No fix recorded)
hono-adapter-mqtt< 2.7.0-r33
hono-cli< 2.7.0-r33
hono-service-auth< 2.7.0-r33
hono-service-command-router< 2.7.0-r33
hono-service-device-registry-jdbc< 2.7.0-r33
infinispan-15.0< 15.0.22-r14
infinispan-15.1< 15.1.7-r25
kafbat-ui-fips< 1.5.0-r6
kafka_exporter-strimzi-compat< 1.2.0-r5 | < 1.2.0-r4
kafka-bridge< 1.0.0-r9
kafka-bridge-fips< 1.0.0-r6
kafka-strimzi-compat< 1.2.0-r5 | All versions (No fix recorded)
kayenta-2025.2All versions (No fix recorded)
kayenta-2025.4< 2025.4.6-r11
kayenta-2026.0< 2026.0.4-r17
kayenta-2026.1< 2026.1.2-r1
kayenta-fips-2025.2All versions (No fix recorded)
kayenta-fips-2025.4< 2025.4.6-r6
kayenta-fips-2026.1< 2026.1.2-r1
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.5-operatorAll versions (No fix recorded)
keycloak-26.6< 26.6.6-r0
keycloak-26.6-iamguarded-compat< 26.6.6-r0
keycloak-26.6-operator< 26.6.6-r0
keycloak-26.7< 26.7.0-r8
keycloak-26.7-iamguarded-compat< 26.7.0-r8
keycloak-26.7-operator< 26.7.0-r8
keycloak-fips-26.5All versions (No fix recorded)
keycloak-fips-26.5-iamguarded-fipsAll versions (No fix recorded)
keycloak-fips-26.5-operatorAll versions (No fix recorded)
keycloak-fips-26.6< 26.6.6-r0
keycloak-fips-26.6-iamguarded-fips< 26.6.6-r0
keycloak-fips-26.6-operator< 26.6.6-r0
keycloak-fips-26.7< 26.7.0-r6
keycloak-fips-26.7-iamguarded-fips< 26.7.0-r6
keycloak-fips-26.7-operator< 26.7.0-r6
knative-kafka-broker-1.20-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-1.20-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-1.21-dispatcher-loom< 1.21.4-r14
knative-kafka-broker-1.21-receiver-loom< 1.21.4-r14
knative-kafka-broker-1.22-dispatcher-loom< 1.22.3-r4
knative-kafka-broker-1.22-receiver-loom< 1.22.3-r4
knative-kafka-broker-fips-1.20-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-fips-1.20-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.2-r12
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.2-r12
management-api-for-apache-cassandra-5.0< 0.1.122-r2
metabaseAll versions (No fix recorded) | < 0.63.19-r3
opensearch-2-repository-azure< 2.19.6-r6
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compat< 3.8.0-r3
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-repository-azure< 3.7.0-r5
opensearch-fips-3-repository-azure< 3.7.0-r5
pinot< 1.5.1-r9
pinot-fips< 1.5.1-r6
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
request-9047-keycloak-fips-26.4< 26.4.7-r28
request-9047-keycloak-fips-26.4-iamguarded-fips< 26.4.7-r28
request-9047-keycloak-fips-26.4-operator< 26.4.7-r28
request-9047-keycloak-fips-26.5< 26.5.7-r18
request-9047-keycloak-fips-26.5-iamguarded-fips< 26.5.7-r18
request-9047-keycloak-fips-26.5-operator< 26.5.7-r18
request-9047-keycloak-fips-26.6< 26.6.4-r10
request-9047-keycloak-fips-26.6-iamguarded-fips< 26.6.4-r10
request-9047-keycloak-fips-26.6-operator< 26.6.4-r10
s3proxy< 3.3.0-r7
s3proxy-fips< 3.3.0-r6
seata-server< 2.7.0-r3
sonarqubeAll versions (No fix recorded)
spark-4.0-scala-2.13< 4.0.4-r1
spark-4.1-scala-2.13< 4.1.3-r2
spark-4.2-scala-2.13< 4.2.0-r4
spark-fips-4.1-scala-2.13< 4.1.2-r6
spark-fips-4.2-scala-2.13< 4.2.0-r3
spark-kubernetes-operator< 0.9.0-r6
spark-kubernetes-operator-fips< 1.0.0-r0
strimzi-kafka-operator< 1.2.0-r5
strimzi-kafka-operator-cluster-operator< 1.2.0-r4 | < 1.1.0-r4 | < 1.2.0-r5
strimzi-kafka-operator-fips-cluster-operator< 1.1.0-r1
strimzi-kafka-operator-fips-kafka-agent< 1.1.0-r1
strimzi-kafka-operator-fips-kafka-init< 1.1.0-r1
strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc< 1.1.0-r1
strimzi-kafka-operator-fips-topic-operator< 1.1.0-r1
strimzi-kafka-operator-fips-tracing-agent< 1.1.0-r1
strimzi-kafka-operator-fips-user-operator< 1.1.0-r1
strimzi-kafka-operator-kafka-agent< 1.2.0-r5 | All versions (No fix recorded) | < 1.1.0-r4
strimzi-kafka-operator-kafka-base< 1.2.0-r5
strimzi-kafka-operator-kafka-init< 1.2.0-r5 | All versions (No fix recorded) | < 1.1.0-r4
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs-ccAll versions (No fix recorded) | < 1.1.0-r4 | < 1.2.0-r5
strimzi-kafka-operator-topic-operator< 1.2.0-r4 | < 1.2.0-r5 | < 1.1.0-r4
strimzi-kafka-operator-tracing-agent< 1.1.0-r4 | < 1.2.0-r5
strimzi-kafka-operator-user-operator< 1.2.0-r5 | < 1.1.0-r4
tez< 0.10.5-r24
thingsboard-tb-mqtt-transport< 4.3.1.3-r11
thingsboard-tb-node< 4.3.1.3-r11
traccar< 6.14.5-r1
traccar-fips< 6.14.5-r2
zipkin< 3.6.1-r19
zipkin-slim< 3.6.1-r19

Show all 166

Wolfi34 products

akhq< 0.27.1-r14
apache-nifi< 2.10.0-r9
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.3-r3
apicurio-registry< 3.3.0-r12

Show all 34

2 vendors · 200 products · Showing 200 of 209. Use Open JSON for the complete list.

References

13 links

github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bX Refsource MISCREPORTFIXWEBPatch
github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6X Refsource MISCREPORTFIXWEBPatch
github.com/netty/netty/releases/tag/netty-4.1.136.FinalX Refsource MISCREPORTWEBRelease Notes
github.com/netty/netty/releases/tag/netty-4.2.16.FinalX Refsource MISCREPORTWEBRelease Notes
ubuntu.com/security/CVE-2026-73508REPORT
www.cve.org/CVERecord?id=CVE-2026-73508REPORT
security-tracker.debian.org/tracker/CVE-2026-73508Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73508.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-73508Advisory

Show all 13 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities