7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42579

CVE-2026-42579: Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42579

CVE-2026-42579:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-codec-dns	maven	>= 4.2.0.Alpha1, <= 4.2.12.Final	4.2.13.Final
io.netty:netty-codec-dns	maven	<= 4.1.132.Final	4.1.133.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis was performed by first identifying the patched versions from the vulnerability description (4.2.13.Final and 4.1.133.Final) and their corresponding vulnerable predecessors (4.2.12.Final and 4.1.132.Final). By comparing the git tags for these versions, the specific commits that contain the security fix were located. The primary fixing commit is 6459a284e6653c90fe4b15c0e8516d8302b1cd0e.

An examination of this commit's patch file reveals changes exclusively in io.netty.handler.codec.dns.DnsCodecUtil.java. The changes directly address the described vulnerabilities by adding strict input validation checks to two static methods: encodeDomainName and decodeDomainName.

encodeDomainName: The patch adds checks to throw exceptions if a domain name contains empty labels, labels longer than 63 bytes, null characters, or if the total length exceeds 255 bytes. The vulnerable version lacked these checks, making it susceptible to creating malformed DNS queries.
decodeDomainName: The patch adds checks to throw an exception if a decoded label exceeds 63 bytes or if the total decoded domain name exceeds 255 bytes. The vulnerable version lacked these checks, leading to an uncontrolled resource consumption vulnerability.

These two functions are the root cause of the vulnerability. Any exploitation attempt would necessarily involve one or both of these functions processing malicious data, making them the key indicators in a runtime profile.

Vulnerable functions

io.netty.handler.codec.dns.DnsCodecUtil.encodeDomainName

codec-dns/src/main/java/io/netty/handler/codec/dns/DnsCodecUtil.java

The `encodeDomainName` function was vulnerable because it failed to validate the input domain name against RFC 1035 standards before encoding it. Specifically, it did not check for null bytes, labels exceeding the 63-byte limit, or total domain names exceeding the 255-byte limit. This allowed an attacker to craft a malicious domain name string, which, when processed by this function, would result in a malformed DNS packet. This could lead to DNS cache poisoning, domain validation bypasses, or parser confusion in downstream DNS resolvers.

io.netty.handler.codec.dns.DnsCodecUtil.decodeDomainName

codec-dns/src/main/java/io/netty/handler/codec/dns/DnsCodecUtil.java

The `decodeDomainName` function was vulnerable to uncontrolled resource consumption (Denial of Service). When decoding a DNS response from a ByteBuf, it did not validate that the length of individual labels was within the 63-byte limit or that the total reconstructed domain name was within the 255-byte limit. An attacker could send a malicious DNS response with oversized labels, causing the `StringBuilder` within this function to grow without bounds, leading to excessive memory allocation and a server crash.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.