CVE-2026-42579

EUVD-2026-30122
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 56.29%
Affected Products (NVD)
VendorProductVersion
nettynetty
𝑥
< 4.1.133
nettynetty
4.2.0 ≤
𝑥
< 4.2.13
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatCryostat 4 on RHEL 9
4.2.0-10 ≤
𝑥
< *
ADP
Red HatRed Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
codec-dns ≤
𝑥
< *
ADP
Red HatRed Hat build of Quarkus 3.27.4
codec-dns ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.16.0-22.redhat_00057.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.3.14-11.SP11_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:1.5.26-2.Final_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.18.8-1.redhat_00003.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:5.0.31-3.SP2_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:1.10.0-46.Final_redhat_00044.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:4.1.135-1.Final_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.5.5-30.SP12_redhat_00020.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.5.5-24.SP12_redhat_00016.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.2.40-2.SP3_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:7.4.25-2.GA_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.16.0-22.redhat_00057.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.3.14-11.SP11_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:1.5.26-2.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.18.8-1.redhat_00003.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:5.0.31-3.SP2_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:1.10.0-46.Final_redhat_00044.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:4.1.135-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.5.5-30.SP12_redhat_00020.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.5.5-24.SP12_redhat_00016.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.2.40-1.SP3_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:7.4.25-2.GA_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.16.0-22.redhat_00057.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.3.14-11.SP11_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:1.5.26-2.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.18.8-1.redhat_00003.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:5.0.31-3.SP2_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:1.10.0-46.Final_redhat_00044.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:4.1.135-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.5.5-30.SP12_redhat_00020.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.5.5-24.SP12_redhat_00016.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.2.40-1.SP3_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:7.4.25-2.GA_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1.7.GA
4.1.135.Final-redhat-00001 ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
0:801.7.1-1.GA_redhat_00001.1.el10eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
0:4.1.135-1.Final_redhat_00001.1.el10eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
0:8.1.7.1-1.GA_redhat_00004.1.el10eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:801.7.1-1.GA_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:0.9.6-2.redhat_00002.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:4.1.135-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:8.1.7.1-1.GA_redhat_00004.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:801.7.1-1.GA_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:0.9.6-2.redhat_00002.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:4.1.135-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:8.1.7.1-1.GA_redhat_00004.1.el9eap ≤
𝑥
< *
ADP
Red HatStreams for Apache Kafka 3.2.1
codec-dns ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1788198681 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780948325 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780696380 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780694994 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.29
1782989027 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
netty
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
netty
bionic
not-affected
focal
Fixed 1:4.1.45-1ubuntu0.1~esm6
released
jammy
Fixed 1:4.1.48-4+deb11u2ubuntu0.1+esm3
released
noble
Fixed 1:4.1.48-9ubuntu0.1+esm3
released
questing
ignored
resolute
Fixed 1:4.1.48-16ubuntu0.1~esm2
released
trusty
not-affected
xenial
not-affected
Common Weakness Enumeration
References
https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm
https://access.redhat.com/errata/RHSA-2026:23808
https://access.redhat.com/errata/RHSA-2026:24502
https://access.redhat.com/errata/RHSA-2026:25123
https://access.redhat.com/errata/RHSA-2026:28010
https://access.redhat.com/errata/RHSA-2026:36820
https://access.redhat.com/errata/RHSA-2026:37390
https://access.redhat.com/errata/RHSA-2026:49700
https://access.redhat.com/errata/RHSA-2026:49701
https://access.redhat.com/errata/RHSA-2026:53644
https://access.redhat.com/errata/RHSA-2026:53645
https://access.redhat.com/errata/RHSA-2026:53646
https://access.redhat.com/errata/RHSA-2026:54435
https://access.redhat.com/errata/RHSA-2026:65126
https://access.redhat.com/security/cve/CVE-2026-42579
https://bugzilla.redhat.com/show_bug.cgi?id=2477217
https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42579.json