CVE-2026-73508

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description An issue exists where the framework fails to release retained or newly allocated ByteBuf objects when a malformed domain name is rejected by IDN.toASCII() or encodeDomainName(). This occurs within io.netty.handler.codec.dns.AbstractDnsRecord, the decodeRecord() function in io.netty.handler.codec.dns.DefaultDnsRecordDecoder, and the decompressDomainName() function in io.netty.handler.codec.dns.DnsCodecUtil. Consequently, unauthenticated remote DNS packets can cause incremental direct memory leaks, potentially leading to a denial of service.

Recommendations Update to version 4.1.136.Final. Update to version 4.2.16.Final.