critical
CVE-2026-42579
netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GHSA7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (high), Ubuntu (medium).
Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| chainguard | akhq, apache-hop, apache-hop-fips and 83 more | 0.27.1-r1 and 70 more |
| debian 11 | netty | no fix listed |
| debian 12 | netty | no fix listed |
| debian 13 | netty | no fix listed |
| debian 14 | netty | no fix listed |
| echo | netty | no fix listed |
| echo maven::Echo OSV | io.netty:netty-codec-dns | 4.1.133.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-codec-dns | 4.2.13.Final, 4.1.133.Final |
| minimos | akhq, akhq-fips, apache-druid and 35 more | 0.28.0-r0 and 25 more |
| rapidfort debian 12 | netty | no fix listed |
| rapidfort debian 13 | netty | no fix listed |
| ubuntu 20.04-ESM | netty | 1:4.1.45-1ubuntu0.1~esm6 |
Show all 159 entries from 17 sources
| Source | Package | Fixed in |
|---|---|---|
| chainguard | akhq | 0.27.1-r1 |
| chainguard | apache-hop | 2.17.0-r13 |
| chainguard | apache-hop-fips | 2.17.0-r13 |
| chainguard | apache-nifi | 2.9.0-r6 |
| chainguard | apache-pulsar-4.0 | 4.0.10-r1 |
| chainguard | apache-pulsar-4.1 | 4.1.3-r15 |
| chainguard | apache-pulsar-4.2 | 4.2.1-r2 |
| chainguard | apache-pulsar-fips-4.0 | 4.0.9-r16 |
| chainguard | apache-pulsar-fips-4.2 | 4.2.1-r3 |
| chainguard | apicurio-registry | 3.2.1-r5 |
| chainguard | apicurio-registry-fips | 3.3.0-r1 |
| chainguard | camunda-8.8 | 8.8.24-r1 |
| chainguard | camunda-8.9 | 8.9.5-r2 |
| chainguard | camunda-zeebe-8.6 | 8.6.39-r6 |
| chainguard | camunda-zeebe-8.7 | 8.7.29-r1 |
| chainguard | camunda-zeebe-8.8 | 8.8.24-r1 |
| chainguard | camunda-zeebe-8.9 | 8.9.5-r2 |
| chainguard | celeborn-0.5 | 0.5.4-r26 |
| chainguard | celeborn-0.6 | 0.6.3-r7 |
| chainguard | celeborn-0.7 | 0.7.0-r7 |
| chainguard | commercial-elasticsearch-8.19 | 8.19.16-r0 |
| chainguard | commercial-elasticsearch-9.3 | 9.3.5-r0 |
| chainguard | commercial-elasticsearch-9.4 | 9.4.1-r0 |
| chainguard | druid | 37.0.0-r3 |
| chainguard | elasticsearch-8.19 | 8.19.15-r1 |
| chainguard | elasticsearch-9.1 | 9.1.10-r5 |
| chainguard | elasticsearch-9.2 | 9.2.8-r3 |
| chainguard | elasticsearch-9.3 | 9.3.4-r1 |
| chainguard | elasticsearch-9.4 | 9.4.1-r0 |
| chainguard | elasticsearch-fips-8.19 | 8.19.15-r1 |
| chainguard | elasticsearch-fips-9.1 | 9.1.10-r12 |
| chainguard | elasticsearch-fips-9.2 | 9.2.8-r1 |
| chainguard | elasticsearch-fips-9.3 | 9.3.4-r1 |
| chainguard | elasticsearch-fips-9.4 | 9.4.1-r0 |
| chainguard | flyway | 12.6.0-r0 |
| chainguard | flyway-fips | 12.6.0-r0 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r3 |
| chainguard | hono | 2.7.0-r15 |
| chainguard | infinispan-15.0 | 15.0.22-r7 |
| chainguard | infinispan-15.1 | 15.1.7-r15 |
| chainguard | infinispan-15.2 | 15.2.6-r15 |
| chainguard | infinispan-16.0 | 16.0.11-r2 |
| chainguard | infinispan-16.1 | 16.1.3-r2 |
| chainguard | kafbat-ui | 1.4.2-r10 |
| chainguard | kafbat-ui-fips | 1.4.2-r9 |
| chainguard | kafka-bridge | 0.33.1-r16 |
| chainguard | kafka-bridge-fips | 0.33.1-r11 |
| chainguard | kayenta-2025.4 | 2025.4.3-r8 |
| chainguard | kayenta-2026.0 | 2026.0.2-r8 |
| chainguard | kayenta-2026.1 | 2026.1.0-r1 |
| chainguard | kayenta-fips-2025.4 | 2025.4.3-r9 |
| chainguard | kayenta-fips-2026.0 | 2026.0.2-r9 |
| chainguard | kayenta-fips-2026.1 | 2026.1.0-r1 |
| chainguard | keycloak-26.6 | 26.6.1-r2 |
| chainguard | keycloak-fips-26.6 | 26.6.1-r4 |
| chainguard | knative-kafka-broker-1.20 | 1.20.3-r6 |
| chainguard | knative-kafka-broker-1.21 | 1.21.3-r2 |
| chainguard | knative-kafka-broker-1.22 | 1.22.0-r2 |
| chainguard | knative-kafka-broker-fips-1.20 | 1.20.3-r6 |
| chainguard | knative-kafka-broker-fips-1.21 | 1.21.3-r4 |
| chainguard | knative-kafka-broker-fips-1.22 | 1.22.0-r2 |
| chainguard | management-api-for-apache-cassandra-4.0 | 0.1.117-r1 |
| chainguard | management-api-for-apache-cassandra-4.1 | 0.1.117-r1 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.117-r1 |
| chainguard | opensearch-2 | 2.19.4-r14 |
| chainguard | opensearch-3 | 3.6.0-r5 |
| chainguard | opensearch-fips-3 | 3.7.0-r0 |
| chainguard | pinot | 1.5.0-r4 |
| chainguard | pinot-fips | 1.5.0-r3 |
| chainguard | s3proxy | 3.1.0-r2 |
| chainguard | s3proxy-fips | 3.1.0-r2 |
| chainguard | seata | 2.6.0-r9 |
| chainguard | sonarqube | 26.7.0.124771-r0 |
| chainguard | spark-4.0 | 4.0.2-r12 |
| chainguard | spark-4.1 | 4.1.2-r1 |
| chainguard | spark-fips-4.1 | 4.1.1-r14 |
| chainguard | spark-kubernetes-operator | 0.9.0-r0 |
| chainguard | spark-kubernetes-operator-fips | 0.9.0-r0 |
| chainguard | strimzi-kafka-operator | 0.51.0-r26 |
| chainguard | strimzi-kafka-operator-fips | 1.0.0-r0 |
| chainguard | tez | 0.10.5-r12 |
| chainguard | thingsboard | 4.3.1.1-r8 |
| chainguard | tinkerpop | 3.8.1-r2 |
| chainguard | trino | 481-r0 |
| chainguard | wildfly | 39.0.1-r8 |
| chainguard | zipkin | 3.6.1-r6 |
| debian 11 | netty | no fix listed |
| debian 12 | netty | no fix listed |
| debian 13 | netty | no fix listed |
| debian 14 | netty | no fix listed |
| echo | netty | no fix listed |
| echo maven::Echo OSV | io.netty:netty-codec-dns | 4.1.133.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-codec-dns | 4.2.13.Final, 4.1.133.Final |
| minimos | akhq | 0.28.0-r0 |
| minimos | akhq-fips | 0.28.0-r0 |
| minimos | apache-druid | 38.0.0-r0 |
| minimos | apache-druid-fips | 38.0.0-r0 |
| minimos | apache-nifi | 2.10.0-r0 |
| minimos | apache-polaris | 1.6.0-r0 |
| minimos | apache-polaris-fips | 1.6.0-r0 |
| minimos | apicurio-registry | 3.2.5-r0 |
| minimos | apicurio-registry-fips | 3.3.1-r0 |
| minimos | camunda-8.8 | 8.8.25-r0 |
| minimos | cdc-apache-cassandra-fips-5.0 | 2.3.9-r0 |
| minimos | conductor | 3.32.1-r0 |
| minimos | conductor-fips | 3.32.1-r0 |
| minimos | elasticsearch-8.19 | 8.19.16-r0 |
| minimos | elasticsearch-9.3 | 9.3.5-r0 |
| minimos | elasticsearch-9.4 | 9.4.1-r0 |
| minimos | elasticsearch-fips-8.19 | 8.19.16-r0 |
| minimos | elasticsearch-fips-9.3 | 9.3.5-r0 |
| minimos | keycloak | 26.6.3-r0 |
| minimos | keycloak-fips | 26.6.3-r0 |
| minimos | knative-kafka-broker-dispatcher-loom-1.22 | 1.22.2-r0 |
| minimos | knative-kafka-broker-dispatcher-loom-fips-1.22 | 1.22.2-r0 |
| minimos | knative-kafka-broker-receiver-loom-1.21 | 1.21.4-r1 |
| minimos | knative-kafka-broker-receiver-loom-1.22 | 1.22.2-r0 |
| minimos | knative-kafka-broker-receiver-loom-fips-1.22 | 1.22.2-r0 |
| minimos | linstor-server | 1.35.0-r0 |
| minimos | linstor-server-fips | 1.35.0-r0 |
| minimos | opensearch-2 | 2.19.6-r0 |
| minimos | opensearch-3 | 3.7.0-r0 |
| minimos | sonarqube | 26.7.0.124771-r0 |
| minimos | stargate | 2.0.51-r2 |
| minimos | strimzi-kafka-bridge | 1.0.0-r1 |
| minimos | strimzi-kafka-bridge-fips | 1.1.0-r0 |
| minimos | strimzi-kafka-operator | 1.0.1-r3 |
| minimos | strimzi-kafka-operator-0.45 | 0.45.2-r6 |
| minimos | strimzi-kafka-operator-fips | 1.0.1-r1 |
| minimos | trino | 481-r2 |
| minimos | trino-fips | 481-r2 |
| rapidfort debian 12 | netty | no fix listed |
| rapidfort debian 13 | netty | no fix listed |
| ubuntu 20.04-ESM | netty | 1:4.1.45-1ubuntu0.1~esm6 |
| ubuntu 22.04 | netty | no fix listed |
| ubuntu 24.04 | netty | no fix listed |
| ubuntu 26.04 | netty | no fix listed |
| ubuntu 26.10 | netty | no fix listed |
| wolfi | akhq | 0.27.1-r1 |
| wolfi | apache-nifi | 2.9.0-r6 |
| wolfi | apache-pulsar-4.1 | 4.1.3-r15 |
| wolfi | apache-pulsar-4.2 | 4.2.1-r2 |
| wolfi | apicurio-registry | 3.2.1-r5 |
| wolfi | celeborn-0.6 | 0.6.3-r7 |
| wolfi | druid | 37.0.0-r3 |
| wolfi | flyway | 12.6.0-r0 |
| wolfi | infinispan-16.1 | 16.1.3-r2 |
| wolfi | keycloak-26.6 | 26.6.1-r2 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.117-r1 |
| wolfi | opensearch-3 | 3.6.0-r5 |
| wolfi | sonarqube | 26.7.0.124771-r0 |
| wolfi | spark-4.0 | 4.0.2-r12 |
| wolfi | spark-4.1 | 4.1.2-r1 |
| wolfi | strimzi-kafka-operator | 0.51.0-r26 |
| wolfi | tez | 0.10.5-r12 |
| wolfi | thingsboard | 4.3.1.1-r8 |
| wolfi | trino | 481-r0 |
| wolfi | wildfly | 39.0.1-r8 |
| wolfi | zipkin | 3.6.1-r6 |
References
- https://access.redhat.com/errata/RHSA-2026:23808
- https://access.redhat.com/errata/RHSA-2026:24502
- https://access.redhat.com/errata/RHSA-2026:25123
- https://access.redhat.com/errata/RHSA-2026:28010
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:49700
- https://access.redhat.com/errata/RHSA-2026:49701
All 24 references
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/security/cve/CVE-2026-42579
- https://advisory.echohq.com/cve/CVE-2026-42579
- https://bugzilla.redhat.com/show_bug.cgi?id=2477217
- https://github.com/netty/netty
- https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm
- https://nvd.nist.gov/vuln/detail/CVE-2026-42579
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42579.json
- https://tools.ietf.org/html/rfc1035#section-2.3.4
- https://tools.ietf.org/html/rfc1035#section-4.1.4
- https://ubuntu.com/security/notices/USN-8401-1
- https://www.cve.org/CVERecord?id=CVE-2026-42579