Io.netty:netty codec dns: Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names (CVE-2026-73508)
A memory leak vulnerability exists in Netty's DNS codec due to improper handling of malformed domain names. When invalid domain names cause exceptions during DNS record decoding, allocated buffers are not released, leading to incremental memory leaks. Sustained exploitation can cause resource exhaustion and denial of service in applications using Netty's DnsRecordDecoder.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-73508) arises in io.netty.handler.codec.dns.AbstractDnsRecord where invalid domain names cause IDN.toASCII(name) to throw IllegalArgumentException before the DNS record instance can properly assign and release its buffer. This results in unreleased ByteBuf instances and a direct memory leak. Multiple code paths, including DefaultDnsRecordDecoder.decodeRecord and DnsCodecUtil.decompressDomainName, exhibit this behavior when processing malformed DNS packets. Applications using Netty's DNS codec, such as DnsNameResolver or custom DNS servers, are vulnerable to resource exhaustion through sustained malicious DNS requests.
Potential Impact
The vulnerability leads to a memory leak that accumulates with each malformed DNS packet processed, potentially causing resource exhaustion and denial of service in affected applications. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A patch is available to address this vulnerability. Users of the affected Netty DNS codec should apply the official fix provided by the vendor. Since this is not a cloud service, remediation requires updating the affected library version. Check the vendor advisory or official Netty repository for the specific patched versions and update accordingly.
Io.netty:netty codec dns: Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names (CVE-2026-73508)
Description
A memory leak vulnerability exists in Netty's DNS codec due to improper handling of malformed domain names. When invalid domain names cause exceptions during DNS record decoding, allocated buffers are not released, leading to incremental memory leaks. Sustained exploitation can cause resource exhaustion and denial of service in applications using Netty's DnsRecordDecoder.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-73508) arises in io.netty.handler.codec.dns.AbstractDnsRecord where invalid domain names cause IDN.toASCII(name) to throw IllegalArgumentException before the DNS record instance can properly assign and release its buffer. This results in unreleased ByteBuf instances and a direct memory leak. Multiple code paths, including DefaultDnsRecordDecoder.decodeRecord and DnsCodecUtil.decompressDomainName, exhibit this behavior when processing malformed DNS packets. Applications using Netty's DNS codec, such as DnsNameResolver or custom DNS servers, are vulnerable to resource exhaustion through sustained malicious DNS requests.
Potential Impact
The vulnerability leads to a memory leak that accumulates with each malformed DNS packet processed, potentially causing resource exhaustion and denial of service in affected applications. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A patch is available to address this vulnerability. Users of the affected Netty DNS codec should apply the official fix provided by the vendor. Since this is not a cloud service, remediation requires updating the affected library version. Check the vendor advisory or official Netty repository for the specific patched versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mfg7-5gfp-c4w3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-73508"]
- Ecosystems
- ["Maven"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a7e036ebf8831d5398f92f1
Added to database: 08/13/2026, 17:48:30 UTC
Last enriched: 08/13/2026, 18:09:42 UTC
Last updated: 08/13/2026, 18:09:42 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.