CVE-2026-42579: Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)

May 7, 2026 (updated June 11, 2026)

Field	Value
Product	Netty
Version	4.2.12.Final (and all prior versions with codec-dns)
Component	`io.netty.handler.codec.dns.DnsCodecUtil`
Vulnerability Type	CWE-20: Improper Input Validation / CWE-626: Null Byte Interaction Error / CWE-400: Uncontrolled Resource Consumption
Impact	DNS Cache Poisoning / Domain Validation Bypass / Denial of Service / Malformed DNS Packets

References

github.com/advisories/GHSA-cm33-6792-r9fm
github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm
nvd.nist.gov/vuln/detail/CVE-2026-42579
tools.ietf.org/html/rfc1035
tools.ietf.org/html/rfc1035

Code Behaviors & Features

Detect and mitigate CVE-2026-42579 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →