CVE-2026-42579 is a high severity flaw (CVSS 7.5) in the DNS codec of Netty, the Java network framework. It does not enforce RFC 1035 domain name rules when encoding or decoding. Malicious responses and user influenced hostnames can both exploit it. Upgrade to Netty 4.2.13.Final or 4.1.133.Final.
What's affected
The record and the advisory give the same ranges for Netty:
- The 4.2 line: versions up to and including 4.2.12.Final, fixed in 4.2.13.Final.
- The 4.1 line: versions up to and including 4.1.132.Final, fixed in 4.1.133.Final.
Netty sits underneath many Java products, including web servers, clients, gateways and message systems. You may be using it without a direct dependency, through another library. Red Hat has also issued errata for this family of Netty fixes, so Red Hat products may carry their own fixed build numbers.
How to check if you're exposed
Find every Netty version on your classpath, including transitive ones.
mvn dependency:tree -Dincludes=io.netty
gradle dependencies | grep netty
For a finished application, list the jars in the deployment (for example netty-codec-http or netty-codec-dns) and read the version from the file name. Check container images as well, since a fat jar can hide a Netty copy.
Compare each result with 4.2.13.Final and 4.1.133.Final. A Safeguard dependency scan reads your manifests and lock files and shows transitive Netty versions.
What to do now
- Upgrade Netty to 4.2.13.Final on the 4.2 line or 4.1.133.Final on the 4.1 line.
- Where Netty comes in through another library, upgrade that library or add a dependency constraint that pins the fixed Netty version.
- Rebuild and redeploy containers and shaded jars, since updating the manifest alone does not change an already built artifact.
- If you use a vendor product built on Netty, check the vendor advisory or the Red Hat errata for your platform.
- Run a dependency scan afterwards to confirm no older Netty copy is left.
Why it matters
The record lists four weakness classes: CWE-1286 (improper validation of syntactic correctness of input), CWE-20 (improper input validation), CWE-400 (uncontrolled resource consumption) and CWE-626 (null byte interaction error). They all describe one gap. Domain names have strict rules about length and allowed bytes, and the codec accepted names that break them.
The advisory calls this a two way problem. A hostile DNS reply can abuse the decoder, and a hostname that a user can influence can abuse the encoder. It names cache poisoning, domain validation bypass and denial of service as possible results. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect me if I never call the DNS codec directly?
Possibly. Netty based resolvers and clients can use it for you. Check which Netty version ships in your build, then upgrade.
Sources
Last reviewed: 19 October 2026.
