CVE-2026-73508: Netty

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected products

• Netty Netty: before 4.1.136 (fixed in 4.1.136); from 4.2.0, before 4.2.16 (fixed in 4.2.16)

Published 2026-08-13. Last modified 2026-09-23.