CVE-2026-73508

The record

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected packages

Related vulnerabilities

• CVE-2026-59951 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-772
• CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending forever. CWE-772
• CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets… CWE-772
• CVE-2026-59320 When a container-level ErrorHandler is configured (the mitigation for finding 221000)… CWE-772
• CVE-2026-73215 Coturn is a free open source implementation of TURN and STUN Server. CWE-772
• CVE-2026-11811 The UpdateHub over-the-air update client's start_coap_client() in… CWE-772
• CVE-2026-13505 In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2… CWE-772
• CVE-2026-49343 Klever-Go is the Go implementation of the Klever blockchain protocol. CWE-772