CyberRota Analysis
AI-GeneratedNetty versions prior to 4.1.136.Final and 4.2.16.Final are vulnerable due to improper memory management in the DNS handling components, which can lead to incremental memory leaks when processing malformed domain names. This vulnerability allows unauthenticated remote DNS packets to consume memory, potentially resulting in a denial of service. Organizations using affected versions of Netty should prioritize upgrading to the patched versions to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.