CVE-2026-73508 : faille élevée netty netty (CVSS 7.5)

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Sévérité

Élevée (CVSS 7.5)

Vecteur CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitation active

Non signalée par la CISA

Publication

13 août 2026

Dernière mise à jour

23 sept. 2026

• netty netty

• Fiche CVE-2026-73508 sur le NVD (NIST)
• github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbe…
• github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b…
• github.com/netty/netty/releases/tag/netty-4.1.136.Final
• github.com/netty/netty/releases/tag/netty-4.2.16.Final
• github.com/netty/netty/security/advisories/GHSA…