Advisory Database
  • Advisories
  • Dependency Scanning
  1. maven
  2. ›
  3. io.netty/netty-codec-dns
  4. ›
  5. CVE-2026-42579

CVE-2026-42579: Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)

May 7, 2026

FieldValue
ProductNetty
Version4.2.12.Final (and all prior versions with codec-dns)
Componentio.netty.handler.codec.dns.DnsCodecUtil
Vulnerability TypeCWE-20: Improper Input Validation / CWE-626: Null Byte Interaction Error / CWE-400: Uncontrolled Resource Consumption
ImpactDNS Cache Poisoning / Domain Validation Bypass / Denial of Service / Malformed DNS Packets

References

  • github.com/advisories/GHSA-cm33-6792-r9fm
  • github.com/netty/netty
  • github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm
  • nvd.nist.gov/vuln/detail/CVE-2026-42579
  • tools.ietf.org/html/rfc1035
  • tools.ietf.org/html/rfc1035

Code Behaviors & Features

Detect and mitigate CVE-2026-42579 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 4.2.0.Alpha1 before 4.2.13.Final, all versions before 4.1.133.Final

Fixed versions

  • 4.2.13.Final
  • 4.1.133.Final

Solution

Upgrade to versions 4.1.133.Final, 4.2.13.Final or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-20: Improper Input Validation
  • CWE-400: Uncontrolled Resource Consumption
  • CWE-626: Null Byte Interaction Error (Poison Null Byte)

Source file

maven/io.netty/netty-codec-dns/CVE-2026-42579.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 09 May 2026 00:19:58 +0000.