CVE-2026-42579 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-42579?
CVE-2026-42579 is a high-severity vulnerability in Netty Netty, published on 13 May 2026.
Official description
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Which versions are affected by CVE-2026-42579?
4 open source packages ship an affected version, including io.netty:netty-codec-dns. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.netty:netty-codec-dns Maven | All versions | 4.1.133.Final |
io.netty:netty-codec-dns Maven | All versions | 4.1.133.Final |
io.netty:netty-codec-dns Maven | From 4.2.0.Alpha1 | 4.2.13.Final |
io.netty:netty-codec-dns Maven | From 4.2.0.Alpha1 | 4.2.13.Final |
Products include Netty Netty.
How do I fix CVE-2026-42579?
Upgrade io.netty:netty-codec-dns to a fixed version for your release line: 4.1.133.Final or 4.2.13.Final.
Is CVE-2026-42579 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42579 exists.
Other vulnerabilities in Netty Netty
- CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
- CVE-2026-75596 Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
- CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
- CVE-2026-55851 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
- CVE-2026-56745 Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
Sources
Also known as CLEANSTART-2026-IT89059, CLEANSTART-2026-OV40735, CLEANSTART-2026-RJ93794, CLEANSTART-2026-VE23252, CLSA-2026-1780361386, CLSA-2026-1793138621 and 76 more.