Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T15:20:17.463Z",
  "pubdate": "2026-08-13T15:20:17.463Z",
  "executiveSummary": "A direct memory leak vulnerability exists in the asynchronous network application framework Netty, specifically within its DNS codec implementation. The vulnerability stems from improper resource management during the processing of malformed domain names in DNS records.\nUnauthenticated remote threat actors can exploit this flaw by transmitting specially crafted, malformed DNS packets to a vulnerable service utilizing Netty. When internal functions fail to process these invalid domain names using IDN.toASCII() or encodeDomainName(), newly allocated or retained ByteBuf objects are not properly released.\nThis behavior results in an incremental direct memory leak with each malicious packet processed. Over time, repeated exploitation exhaust available direct memory, culminating in a denial of service (DoS) condition affecting the host application.\nThe vulnerability affects Netty versions prior to 4.1.136.Final and 4.2.16.Final. Exploitation requires network access to the Netty-based DNS service, but no authentication or elevated privileges are required, making it a severe availability risk for applications exposed to untrusted network traffic.",
  "technicalDetails": "The vulnerability resides in the DNS codec components of the Netty framework, specifically impacting io.netty.handler.codec.dns.AbstractDnsRecord, the decodeRecord method within io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and the decompressDomainName function located in io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName().\nThe root cause of the vulnerability is an inadequate exception and error handling mechanism regarding resource lifecycle management. During the parsing and decoding of incoming DNS packets, ByteBuf instances are allocated or retained to manage domain name structures. When the decoding logic encounters a malformed domain name that triggers validation failures within IDN.toASCII() or encodeDomainName(), exceptions or error paths are executed.\nHowever, these code paths fail to release the associated ByteBuf objects that were previously allocated or retained for the operation. Because direct memory buffers (Direct ByteBufs) allocated via Netty's buffer pooling mechanisms are managed outside the standard Java garbage collection heap, failing to explicitly release them leads to persistent memory accumulation in the off-heap direct memory space.\nThe step-by-step attack flow proceeds as follows: First, an unauthenticated attacker transmits a malformed DNS packet over the network to a service utilizing a vulnerable version of Netty. Second, the Netty DNS decoder parses the packet and invokes io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord() and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() to process the records. Third, during domain name decompression or Internationalized Domain Name conversion via IDN.toASCII(), validation logic rejects the malformed input. Fourth, an exception or error flow is triggered, bypassing the resource release statements that would normally decrement the reference count of the ByteBuf.\nDue to this oversight, the reference-counted ByteBuf remains active in memory. By repeatedly flooding the endpoint with these malformed DNS packets, an attacker causes an incremental, unrecoverable leak of direct memory. Post-exploitation impact is strictly focused on availability, as the continued depletion of off-heap memory ultimately causes the JVM or the host application to crash or become unresponsive due to OutOfMemoryError exceptions related to direct buffer allocation."
}