IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.5Alta

CVE-2026-42579Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16; Red Hat Red Hat build of Quarkus 3.27.4 Publicada: (hace 5 meses)

Descripción

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Debilidad (CWE): CWE-20CWE-400CWE-626CWE-1286

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
amq streams 3.2 —
cryostat 4 —
jboss enterprise application platform 8.1 —
jboss enterprise application platform els 7.4 —
netty netty >= 4.2.0.Alpha1, < 4.2.13.Final, < 4.1.133.Final
openshift ai 2.25 —
openshift devspaces 3.28 —
openshift devspaces 3.29 —
quarkus 3.27 —
quarkus 3.33 —
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat OpenShift Serverless all versions
Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 all versions
Red Hat Red Hat build of Quarkus 3.27.4 all versions
Red Hat Red Hat build of Quarkus 3.33.2 —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA all versions
Red Hat Red Hat OpenShift AI 2.25 all versions
Red Hat Red Hat OpenShift Dev Spaces 3.28 all versions
Red Hat Red Hat OpenShift Dev Spaces 3.29 all versions
Red Hat Streams for Apache Kafka 3.2.1 all versions

Referencias y parches

Coincidencias CPE (NVD) (2)
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* < 4.1.133
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.13