CVE-2026-73508 netty CVE debrief

Who should care

Defenders of systems using Netty for DNS operations should assess exposure and prioritize patching. This includes administrators and security teams responsible for maintaining and securing applications built with Netty.

Why it matters

CVE-2026-73508 is a medium-severity vulnerability in Netty that could lead to a denial-of-service condition through a memory leak. Defenders should assess exposure, prioritize patching, and monitor for potential exploitation attempts. The issue is fixed in Netty versions 4.1.136.Final and 4.2.16.Final.

• Potential for incremental memory leak leading to denial-of-service
• Requires verification of affected versions and exposure
• Remediation priority for systems using vulnerable Netty versions
• Monitoring and exception tracking recommended for suspicious DNS traffic

Technical summary

The vulnerability in Netty arises from the improper handling of malformed domain names in DNS packets. Specifically, the io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() methods failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name. This can lead to a memory leak when unauthenticated remote DNS packets are processed.

Defensive priority

Medium priority for systems using Netty for DNS operations

Recommended defensive actions

• Update Netty to version 4.1.136.Final or 4.2.16.Final
• Review and patch affected systems
• Monitor DNS traffic for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.3 and MEDIUM severity. The issue is fixed in Netty versions 4.1.136.Final and 4.2.16.Final. There is limited information available on the source details, and defenders should verify the affected scope and exposure. The CVE was published on 2026-08-13T15:20:17.463Z and has not been modified since then. Official references from Netty and NIST provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.