io.netty:netty-codec-dns@4.2.15.Final

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in AbstractDnsRecord and DefaultDnsRecordDecoder, where a domain name that violates IDNA rules makes IDN.toASCII() throw before the decoded ByteBuf is assigned to the record's content, leaving the buffer unreleased. An attacker can leak direct memory on each malformed record and exhaust it over sustained traffic by sending DNS records whose domain names violate IDNA rules, contain null bytes in a decompressed name, or otherwise fail to decode. Exploitation affects applications that decode DNS records with Netty's DnsRecordDecoder, such as DnsNameResolver clients processing responses from an attacker-influenced resolver or custom DNS servers, and the leak is incremental, requiring sustained malformed records to exhaust memory.

Upgrade io.netty:netty-codec-dns to version 4.1.136.Final, 4.2.16.Final or higher.