CVE-2026-42579

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Security Vulnerability Report: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

1. Vulnerability Summary

| Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final (and all prior versions with codec-dns) | | Component | io.netty.handler.codec.dns.DnsCodecUtil | | Vulnerability Type | CWE-20: Improper Input Validation / CWE-626: Null Byte Interaction Error / CWE-400: Uncontrolled Resource Consumption | | Impact | DNS Cache Poisoning / Domain Validation Bypass / Denial of Service / Malformed DNS Packets |

2. Affected Components

Both the encoder and decoder in the same file are affected:

• io.netty.handler.codec.dns.DnsCodecUtil — encodeDomainName() method (lines 31-51):

  • No null byte validation in domain name labels
  • No per-label length validation (RFC 1035 max: 63 bytes)
  • No total domain name length validation (RFC 1035 max: 255 bytes)
  • Empty labels silently truncate the domain name

• io.netty.handler.codec.dns.DnsCodecUtil — decodeDomainName() method (lines 53-118):

  • No per-label length validation (max 63)
  • No total domain name length validation (max 255)
  • Unbounded StringBuilder growth from attacker-controlled DNS responses

3. Vulnerability Description

Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder.

3.1 Encoder Side — Null Byte Injection (CWE-626)

A domain name containing a null byte (e.g., "evil\0.example.com") is encoded with the null byte embedded in the label data. This creates a domain name that different DNS implementations interpret differently:

• Java (full string): sees "evil\0.example.com" as a single label containing a null
• C/native DNS libraries: truncate at the null byte, seeing only "evil"
• DNS servers: may accept or reject based on implementation

This differential interpretation enables DNS cache poisoning and domain validation bypass.

3.2 Encoder Side — Overlength Label (RFC 1035 Violation)

Labels exceeding 63 bytes are accepted by the encoder. The length byte is written as a single unsigned byte, so a 200-byte label writes 0xC8 (200) as the length. Per RFC 1035, values 192-255 indicate compression pointers. This means:

• A 200-byte label length 0xC8 would be interpreted as a compression pointer by standards-compliant DNS parsers
• This creates parser confusion between label and pointer interpretation

3.3 Encoder Side — Silent Truncation via Empty Labels

encodeDomainName("a..b.com", buf);
// Encodes as: [01] 'a' [00]
// Only "a." is encoded, ".b.com" is silently dropped!

An attacker can craft input like "safe-domain..evil.com" which gets truncated to just "safe-domain.", potentially bypassing domain allowlists.

3.4 Decoder Side — Unbounded Memory Allocation

The decoder accepts labels of any length (0-255 bytes) without checking the RFC 1035 per-label limit of 63 bytes or the total domain name limit of 255 bytes. A malicious DNS server can return responses with oversized labels, causing excessive memory allocation.

Root Cause — Encoder

// DnsCodecUtil.java:31-51
static void encodeDomainName(String name, ByteBuf buf) {
    if (ROOT.equals(name)) {
        buf.writeByte(0);
        return;
    }
    final String[] labels = name.split("\\.");
    for (String label : labels) {
        final int labelLen = label.length();
        if (labelLen == 0) {
            break;  // NO ERROR - silently truncates!
        }
        // NO check: labelLen > 63
        // NO check: label contains null bytes
        // NO check: total name > 255 bytes
        buf.writeByte(labelLen);                    // Can write values > 63!
        ByteBufUtil.writeAscii(buf, label);         // Null bytes pass through!…

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-codec-dns 4.1.132.Final-rhlw-00002 with a backported security fix.

CVE-2026-42579: Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

This patched artifact is a drop-in replacement for io.netty:netty-codec-dns 4.1.132.Final from Maven Central.

Red Hat Lightwell has released io.netty:netty-codec-dns 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-42579 and CVE-2026-73508.

CVE-2026-42579: Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

CVE-2026-73508: Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

This patched artifact is a drop-in replacement for io.netty:netty-codec-dns 4.1.100.Final from Maven Central.

Root has patched CVE-2026-42579 in the io.netty:netty-codec-dns package for Root:Maven. Multiple fixed versions available.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

TuxCare rebuilt 3 io.netty packages to address 3 CVEs. Fixed in 4.1.115.Final-tuxcare.6.

TuxCare rebuilt io.netty:netty-codec-dns to address 1 CVE. Fixed in 4.1.112.Final-tuxcare.4.

TuxCare rebuilt 4 io.netty packages to address 5 CVEs. Fixed in 4.1.93.Final-tuxcare.2.

TuxCare rebuilt 5 io.netty packages to address 5 CVEs. Fixed in 4.1.92.Final-tuxcare.4.

TuxCare rebuilt 4 io.netty packages to address 5 CVEs. Fixed in 4.1.117.Final-tuxcare.1.

TuxCare rebuilt 7 io.netty packages to address 11 CVEs. Fixed in 4.1.130.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 3 io.netty packages to address 3 CVEs. Fixed in 4.1.73.Final-tuxcare.4.

TuxCare rebuilt 7 io.netty packages to address 8 CVEs. Fixed in 4.1.79.Final-tuxcare.1.

TuxCare rebuilt 3 io.netty packages to address 3 CVEs. Fixed in 4.1.82.Final-tuxcare.7.

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.63.Final-tuxcare.5.

TuxCare rebuilt 12 io.netty packages to address 19 CVEs. Fixed in 4.1.75.Final-tuxcare.5.

TuxCare rebuilt 46 io.netty packages to address 19 CVEs. Fixed in 4.1.80.Final-tuxcare.1.

TuxCare rebuilt 9 io.netty packages to address 13 CVEs. Fixed in 4.1.81.Final-tuxcare.1.

TuxCare rebuilt 15 io.netty packages to address 27 CVEs. Fixed in 4.1.72.Final-tuxcare.1.

TuxCare rebuilt 43 io.netty packages to address 25 CVEs. Fixed in 4.1.68.Final-tuxcare.1.

TuxCare rebuilt 14 io.netty packages to address 26 CVEs. Fixed in 4.1.118.Final-tuxcare.1.

TuxCare rebuilt 14 io.netty packages to address 17 CVEs. Fixed in 4.2.12.Final-tuxcare.1.

TuxCare rebuilt 40 io.netty packages to address 26 CVEs. Fixed in 4.1.53.Final-tuxcare.1.

TuxCare rebuilt 11 io.netty packages to address 21 CVEs. Fixed in 4.1.51.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 7 CVEs. Fixed in 4.1.31.Final-tuxcare.1.

TuxCare rebuilt 7 io.netty packages to address 8 CVEs. Fixed in 4.1.52.Final-tuxcare.4.

TuxCare rebuilt 8 io.netty packages to address 11 CVEs. Fixed in 4.1.43.Final-tuxcare.3.

TuxCare rebuilt 7 io.netty packages to address 9 CVEs. Fixed in 4.1.59.Final-tuxcare.1.

TuxCare rebuilt 5 io.netty packages to address 6 CVEs. Fixed in 4.1.48.Final-tuxcare.5.

TuxCare rebuilt 6 io.netty packages to address 8 CVEs. Fixed in 4.1.38.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 7 CVEs. Fixed in 4.1.23.Final-tuxcare.1.

TuxCare rebuilt 14 io.netty packages to address 16 CVEs. Fixed in 4.2.2.Final-tuxcare.1.

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.42.Final-tuxcare.3.