by Kastro CVE-2026-42579
netty netty — Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
Description · from the CVE record
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Affected
ProductAffectedFixed inSource
netty>= 4.2.0.Alpha1, < 4.2.13.Final–CNA
netty< 4.1.133.Final–CNA
Cryostat 4 on RHEL 9see advisory4.2.0-10redhat-SADP
Cryostat 4 on RHEL 9see advisory4.2.0-10redhat-SADP
Cryostat 4 on RHEL 9see advisory4.2.0-10redhat-SADP
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16see advisorycodec-dnsredhat-SADP
Red Hat build of Quarkus 3.27.4see advisorycodec-dnsredhat-SADP
Red Hat build of Quarkus 3.33.2see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7see advisory0:2.16.0-22.redhat_00057.1.el7eapredhat-SADP
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7see advisory0:2.3.14-11.SP11_redhat_00001.1.el7eapredhat-SADP
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7see advisory0:1.5.26-2.Final_redhat_00001.1.el7eapredhat-SADP
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7see advisory0:2.18.8-1.redhat_00003.1.el7eapredhat-SADP
Scores by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GitHub_M (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
redhat-SADP (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial