CVE-2026-73508 in Netty
Summary
by MITRE • 08/13/2026
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability identified in Netty's DNS handling components represents a critical memory management flaw that can lead to progressive resource exhaustion and eventual denial of service conditions. This issue affects the asynchronous network application framework's ability to properly handle malformed DNS records, specifically within the AbstractDnsRecord class and related DNS record decoding mechanisms. The problem manifests when the framework encounters domain names that fail validation through IDN.toASCII() or encodeDomainName() methods, creating a memory leak scenario where ByteBuf objects are not properly released.
The technical implementation flaw occurs in the DNS record decoding process where retained or newly allocated ByteBuf objects remain unreleased when domain name validation fails. This direct memory leak affects the underlying memory management system through the DnsCodecUtil.decompressDomainName() method, which is responsible for decompressing DNS domain names during packet processing. When malformed domain names are encountered, the framework's error handling path does not properly execute the necessary cleanup operations to release previously allocated memory buffers, resulting in incremental direct memory consumption.
The operational impact of this vulnerability extends beyond simple resource waste, creating a potential vector for remote attackers to systematically consume available direct memory resources without authentication. This allows for progressive degradation of service availability where systems remain operational but increasingly unable to process new DNS requests due to memory exhaustion. The vulnerability is particularly concerning in high-throughput environments where DNS packet processing occurs frequently, as the incremental memory consumption can quickly lead to system instability and complete service unavailability.
This vulnerability maps directly to CWE-401: "Improper Release of Memory Before Removing Last Reference" and aligns with ATT&CK technique T1499.004: "Endpoint Denial of Service" through resource exhaustion attacks. The issue demonstrates poor memory management practices in asynchronous network frameworks where error conditions do not properly execute cleanup routines, creating persistent memory leaks that compound over time. Organizations using Netty versions prior to 4.1.136.Final and 4.2.16.Final should prioritize immediate patching to prevent potential exploitation.
Mitigation strategies include implementing the patched versions of Netty that properly release ByteBuf objects during DNS record validation failures, along with monitoring direct memory usage patterns to detect early signs of resource exhaustion. Network administrators should also consider implementing rate limiting on DNS packet processing and establishing memory allocation thresholds to provide early warning systems. Additionally, regular security assessments of network application frameworks should include verification of proper memory management practices in asynchronous processing components to prevent similar vulnerabilities from emerging in other parts of the system infrastructure.