CVE-2026-42579

What it is

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data tampering.

Exploit odds

1.0% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-05-13 19:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-18 13:18 UTC Last updatedMost recent change to the record

Details

Published

2026-05-13 19:17 UTC

Last modified

2026-09-18 13:18 UTC

Exploit probability

1.0% · EPSS, next 30 days

Weakness

CWE-20 · Improper input validation

Record status

Modified

Affected

• Netty < 4.1.133
• Netty < 4.2.13

Attack profile CVSS 3.1 · 7.5

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None