Homepage

Improper Input Validation The advisory has been revoked - it doesn't affect any version of package netty  (opens in a new tab)

Threat Intelligence

EPSS
1.01% (63rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2510-NETTY-16780867
  • published3 Jun 2026
  • disclosed13 May 2026
Report a new vulnerability Found a mistake?

Introduced: 13 May 2026

CVE-2026-42579  (opens in a new tab)
CWE-20  (opens in a new tab)
CWE-400  (opens in a new tab)
CWE-626  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:25.10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream netty package and not the netty package as distributed by Ubuntu.

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

References