CVE-2026-42579

EUVD-2026-30122
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 58.64%
Affected Products (NVD)
VendorProductVersion
nettynetty
𝑥
< 4.1.133
nettynetty
4.2.0 ≤
𝑥
< 4.2.13
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatCryostat 4 on RHEL 9
4.2.0-10 ≤
𝑥
< *
ADP
Red HatCryostat 4 on RHEL 9
4.2.0-10 ≤
𝑥
< *
ADP
Red HatCryostat 4 on RHEL 9
4.2.0-10 ≤
𝑥
< *
ADP
Red HatRed Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
codec-dns ≤
𝑥
< *
ADP
Red HatRed Hat build of Quarkus 3.27.4
codec-dns ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780948325 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780696380 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780694994 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.29
1782989027 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
netty
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
netty
bionic
not-affected
focal
Fixed 1:4.1.45-1ubuntu0.1~esm6
released
jammy
Fixed 1:4.1.48-4+deb11u2ubuntu0.1+esm3
released
noble
Fixed 1:4.1.48-9ubuntu0.1+esm3
released
questing
ignored
resolute
Fixed 1:4.1.48-16ubuntu0.1~esm2
released
trusty
not-affected