High [CVE-2026-73508] Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names
This high-severity Red Hat Linux advisory covers CVE-2026-73508 affecting Exploit Intelligence, OpenShift Serverless, Red Hat build of Apicurio Registry 3.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.
DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns. DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service.
When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory.
An unauthenticated remote attacker who can send DNS traffic to an application using the affected DNS resolution functionality can incrementally exhaust available memory until the process becomes unresponsive, resulting in a complete denial of service. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-772.
Affected products named by the advisory: Exploit Intelligence; OpenShift Serverless; Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; and 9 more.
- < 4.1.136.Final
- < 4.2.16.Final
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
- 4.1.136
- 4.2.16
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
Mitigation checklist
- Red Hat recommends upgrading to a fixed version as the primary remediation. Where an immediate upgrade is not possible, restrict network access so that only trusted DNS servers and trusted network peers can send DNS traffic to the affected application, using firewall or network policy rules to block or rate-limit DNS traffic from untrusted sources. This reduces exposure to the malformed DNS records that trigger the issue but does not fully eliminate it; upgrading remains the only complete fix.
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.