# CVE-2026-42579

## Summary

- **CVE ID:** CVE-2026-42579
- **Severity:** HIGH
- **CVSS Score:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **CWE:** CWE-20, CWE-400, CWE-626
- **Published:** May 13, 2026
- **Last Modified:** Sep 9, 2026

## Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

## Affected Products

- netty — netty (>= 4.2.0.Alpha1, < 4.2.13.Final)
- netty — netty (< 4.1.133.Final)

## References

- [CNA](https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-42579)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2477217)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42579.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28010)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25123)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23808)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24502)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36820)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37390)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:53644)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:53806)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54435)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:49700)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:65126)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 1.01%
- **EPSS Percentile:** 60.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._