CVE-2026-73508: 
Java vulnerability analysis and mitigation

CVE-2026-73508 is a memory leak vulnerability in Netty's DNS codec that allows unauthenticated remote attackers to cause a gradual Denial of Service by sending malformed DNS packets containing invalid domain names. The flaw affects Netty versions prior to 4.1.136.Final and versions 4.2.0.Final through 4.2.15.Final. It was disclosed on July 23, 2026 via a GitHub Security Advisory and assigned a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is a missing release of ByteBuf objects (CWE-772) in three locations within Netty's DNS codec. In io.netty.handler.codec.dns.AbstractDnsRecord, when IDN.toASCII() throws an IllegalArgumentException due to an IDNA-violating domain name, the constructor exits before the buffer can be assigned to the DnsRecord's content field, leaving the retained or newly allocated ByteBuf unreleased. Similarly, DefaultDnsRecordDecoder.decodeRecord() calls in.retainedDuplicate() or allocates a new buffer when constructing DefaultDnsRawRecord, and DnsCodecUtil.decompressDomainName() allocates a new ByteBuf that leaks if encodeDomainName() throws due to a null byte (\0) in the decompressed domain name. The fix wraps buffer allocations in try/finally blocks to ensure release on exception (GitHub Advisory, Commit 5b68c61).

Successful exploitation causes incremental direct memory leakage with each malformed DNS packet processed, leading to gradual resource exhaustion and eventual Denial of Service. Any application using Netty's DnsRecordDecoder — including those using DnsNameResolver or custom DNS servers built on Netty — is affected. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported. The vulnerability is automatable (no user interaction or privileges required), making it straightforward for an attacker to send a sustained stream of crafted DNS packets to exhaust memory. The EPSS score is approximately 0.333%, indicating low but non-negligible exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Identify target: Locate services using Netty's DNS codec (e.g., applications using DnsNameResolver or custom DNS servers built on Netty versions < 4.1.136.Final or 4.2.0.Final–4.2.15.Final) via network scanning or service fingerprinting.
2. Craft malformed DNS packets: Construct DNS response packets containing resource records (e.g., CNAME, NS, MX, or generic records) with domain names that violate IDNA rules (e.g., characters rejected by IDN.toASCII()) or contain null bytes (\0) in compressed domain name fields.
3. Send sustained packet stream: Transmit a continuous stream of these malformed DNS packets to the target service over UDP or TCP port 53 (or the application's configured DNS port). Each packet causes a small, unreleased ByteBuf allocation in direct memory.
4. Exhaust direct memory: Over time, the accumulated unreleased buffers exhaust the JVM's direct memory pool, causing the application to throw OutOfMemoryError or become unresponsive, achieving Denial of Service (GitHub Advisory).

• Logs: JVM logs or application logs showing repeated java.lang.IllegalArgumentException from IDN.toASCII() or encodeDomainName() within Netty DNS codec classes (AbstractDnsRecord, DefaultDnsRecordDecoder, DnsCodecUtil).
• Logs: java.lang.OutOfMemoryError: Direct buffer memory errors in application logs, indicating exhaustion of off-heap memory.
• Network: High volume of DNS packets with malformed or IDNA-invalid domain names arriving at the application's DNS listener port.
• Process: Steadily increasing direct memory usage (observable via JVM metrics such as java.nio:type=BufferPool,name=direct MBean) without corresponding release, even under stable load.

Upgrade to Netty 4.1.136.Final (for the 4.1.x branch) or 4.2.16.Final (for the 4.2.x branch), which include fixes that wrap ByteBuf allocations in try/finally blocks to ensure proper release on exception. No configuration-based workaround is available; upgrading is the only remediation. Applications using DnsNameResolver or any custom DNS server built on Netty should prioritize this update (GitHub Advisory, Release 4.1.136.Final, Release 4.2.16.Final).

The advisory was published by Netty maintainer chrisvest on GitHub, with credit to reporter violetagg. The fix was included as part of a broader security batch commit addressing multiple Netty codec vulnerabilities. No significant independent researcher commentary or media coverage has been identified beyond standard vulnerability tracking (GitHub Advisory).