GHSA-mfg7-5gfp-c4w3

Source

https://github.com/advisories/GHSA-mfg7-5gfp-c4w3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mfg7-5gfp-c4w3/GHSA-mfg7-5gfp-c4w3.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-mfg7-5gfp-c4w3

Aliases

CVE-2026-73508

Downstream

CGA (488)

CLSA (12)

MINI (61)

Published

2026-07-24T16:52:50Z

Modified

2026-08-13T14:56:24Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

Details

Summary

A memory leak can be caused in Netty's DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occurs incrementally per packet, sustained malicious requests will cause a gradual Denial of Service.

Details

Inside io.netty.handler.codec.dns.AbstractDnsRecord, the parsed domain name string is passed to IDN.toASCII(name). If the domain name contains characters that violate IDNA rules, IDN.toASCII throws an IllegalArgumentException.

Because this exception occurs inside the constructor before the DnsRecord instance can assign the buffer to its content field for later release, the ByteBuf whose reference count was incremented (or newly allocated) is never released, resulting in a direct memory leak.

There are several places where variants of this leak happen:

io.netty.handler.codec.dns.DefaultDnsRecordDecoder#decodeRecord(java.lang.String, io.netty.handler.codec.dns.DnsRecordType, int, long, io.netty.buffer.ByteBuf, int, int) invokes in.retainedDuplicate() or creates a new buffer out when constructing DefaultDnsRawRecord
io.netty.handler.codec.dns.DnsCodecUtil#decompressDomainName allocates a new ByteBuf and passes it to encodeDomainName(). If the decompressed domain name contains a null byte (\0), encodeDomainName() throws an IllegalArgumentException, leaking the newly allocated buffer.

Impact

Resource Exhaustion. Any application utilizing Netty's DnsRecordDecoder (such as DnsNameResolver or custom DNS servers) is vulnerable.

Database specific

{
    "cwe_ids":  [
        "CWE-772"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-24T16:52:50Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Maven / io.netty:netty-codec-dns

Package

Name: io.netty:netty-codec-dns; View open source insights on deps.dev
Purl: pkg:maven/io.netty/netty-codec-dns

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.2.0.Final

Fixed

4.2.16.Final

Affected versions

4.*

4.2.0.Final

4.2.1.Final

4.2.2.Final

4.2.3.Final

4.2.4.Final

4.2.5.Final

4.2.6.Final

4.2.7.Final

4.2.8.Final

4.2.9.Final

4.2.10.Final

4.2.11.Final

4.2.12.Final

4.2.13.Final

4.2.14.Final

4.2.15.Final

Database specific

last_known_affected_version_range

"<= 4.2.15.Final"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mfg7-5gfp-c4w3/GHSA-mfg7-5gfp-c4w3.json"

Maven / io.netty:netty-codec-dns

Package

Name: io.netty:netty-codec-dns; View open source insights on deps.dev
Purl: pkg:maven/io.netty/netty-codec-dns

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.1.136.Final

Affected versions

4.*

4.1.0.Beta1

4.1.0.Beta2

4.1.0.Beta3

4.1.0.Beta4

4.1.0.Beta5

4.1.0.Beta6

4.1.0.Beta7

4.1.0.Beta8

4.1.0.CR1

4.1.0.CR2

4.1.0.CR3

4.1.0.CR4

4.1.0.CR5

4.1.0.CR6

4.1.0.CR7

4.1.0.Final

4.1.1.Final

4.1.2.Final

4.1.3.Final

4.1.4.Final

4.1.5.Final

4.1.6.Final

4.1.7.Final

4.1.8.Final

4.1.9.Final

4.1.10.Final

4.1.11.Final

4.1.12.Final

4.1.13.Final

4.1.14.Final

4.1.15.Final

4.1.16.Final

4.1.17.Final

4.1.18.Final

4.1.19.Final

4.1.20.Final

4.1.21.Final

4.1.22.Final

4.1.23.Final

4.1.24.Final

4.1.25.Final

4.1.26.Final

4.1.27.Final

4.1.28.Final

4.1.29.Final

4.1.30.Final

4.1.31.Final

4.1.32.Final

4.1.33.Final

4.1.34.Final

4.1.35.Final

4.1.36.Final

4.1.37.Final

4.1.38.Final

4.1.39.Final

4.1.40.Final

4.1.41.Final

4.1.42.Final

4.1.43.Final

4.1.44.Final

4.1.45.Final

4.1.46.Final

4.1.47.Final

4.1.48.Final

4.1.49.Final

4.1.50.Final

4.1.51.Final

4.1.52.Final

4.1.53.Final

4.1.54.Final

4.1.55.Final

4.1.56.Final

4.1.57.Final

4.1.58.Final

4.1.59.Final

4.1.60.Final

4.1.61.Final

4.1.62.Final

4.1.63.Final

4.1.64.Final

4.1.65.Final

4.1.66.Final

4.1.67.Final

4.1.68.Final

4.1.69.Final

4.1.70.Final

4.1.71.Final

4.1.72.Final

4.1.73.Final

4.1.74.Final

4.1.75.Final

4.1.76.Final

4.1.77.Final

4.1.78.Final

4.1.79.Final

4.1.80.Final

4.1.81.Final

4.1.82.Final

4.1.83.Final

4.1.84.Final

4.1.85.Final

4.1.86.Final

4.1.87.Final

4.1.88.Final

4.1.89.Final

4.1.90.Final

4.1.91.Final

4.1.92.Final

4.1.93.Final

4.1.94.Final

4.1.95.Final

4.1.96.Final

4.1.97.Final

4.1.98.Final

4.1.99.Final

4.1.100.Final

4.1.101.Final

4.1.102.Final

4.1.103.Final

4.1.104.Final

4.1.105.Final

4.1.106.Final

4.1.107.Final

4.1.108.Final

4.1.109.Final

4.1.110.Final

4.1.111.Final

4.1.112.Final

4.1.113.Final

4.1.114.Final

4.1.115.Final

4.1.116.Final

4.1.117.Final

4.1.118.Final

4.1.119.Final

4.1.120.Final

4.1.121.Final

4.1.122.Final

4.1.123.Final

4.1.124.Final

4.1.125.Final

4.1.126.Final

4.1.127.Final

4.1.128.Final

4.1.129.Final

4.1.130.Final

4.1.131.Final

4.1.132.Final

4.1.133.Final

4.1.134.Final

4.1.135.Final

Database specific

last_known_affected_version_range

"<= 4.1.135.Final"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mfg7-5gfp-c4w3/GHSA-mfg7-5gfp-c4w3.json"