Homepage

Improper Input Validation The advisory has been revoked - it doesn't affect any version of package opensearch-2-reporting  (opens in a new tab)

Threat Intelligence

EPSS
1.01% (63rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-OPENSEARCH2REPORTING-16703830
  • published16 May 2026
  • disclosed13 May 2026
Report a new vulnerability Found a mistake?

Introduced: 13 May 2026

CVE-2026-42579  (opens in a new tab)
CWE-20  (opens in a new tab)
CWE-400  (opens in a new tab)
CWE-626  (opens in a new tab)

Amendment

The Minimos security team deemed this advisory irrelevant for Minimos:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream opensearch-2-reporting package and not the opensearch-2-reporting package as distributed by Minimos.

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

References