GHSA-mfg7-5gfp-c4w3: Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
A memory leak can be caused in Netty’s DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occurs incrementally per packet, sustained malicious requests will cause a gradual Denial of Service.
References
- github.com/advisories/GHSA-mfg7-5gfp-c4w3
- github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- github.com/netty/netty/pull/17063
- github.com/netty/netty/pull/17065
- github.com/netty/netty/releases/tag/netty-4.1.136.Final
- github.com/netty/netty/releases/tag/netty-4.2.16.Final
- github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3
Code Behaviors & Features
Detect and mitigate GHSA-mfg7-5gfp-c4w3 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →