Null Byte Interaction Error (Poison Null Byte) in Netty - CVE-2026-42579

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU130208

Null Byte Interaction Error (Poison Null Byte) in Netty - CVE-2026-42579

Published: May 5, 2026


Vulnerability identifier: #VU130208
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42579
CWE-ID: CWE-626
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass domain validation and poison DNS caches.

The vulnerability exists due to improper input validation in io.netty.handler.codec.dns.DnsCodecUtil encodeDomainName() when encoding user-influenced domain names. A remote attacker can supply a crafted domain name containing null bytes, overlength labels, or empty labels to bypass domain validation and poison DNS caches.

The issue affects the encoder path and relies on applications using user-influenced hostnames to construct DNS queries.


Affected software

Netty
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Ubuntu
SUSE Package Hub 15
Development Tools Module
Voice Gateway
Enterprise Build of Quarkus
DevOps Deploy
Confluence Data Center
UCD - IBM UrbanCode Deploy
Red Hat OpenShift Dev Spaces
Red Hat Integration Camel Extensions for Quarkus
netty-tcnative-debugsource
netty-tcnative
netty (Ubuntu package)
netty-javadoc
netty

How to mitigate CVE-2026-42579

Install security update from vendor's website.

Netty - addressed in versions 4.1.133, 4.2.13
Voice Gateway - update to 1.0.8.27
Enterprise Build of Quarkus - update to 3.27.4
Confluence Data Center - addressed in versions 9.2.21, 10.2.13
UCD - IBM UrbanCode Deploy - addressed in versions 7.2.3.24, 7.3.2.19
DevOps Deploy - addressed in versions 8.0.1.14, 8.1.2.7, 8.2.2.0
netty-tcnative-debugsource - update to 2.0.77-150200.3.39.1
netty-tcnative - update to 2.0.77-150200.3.39.1
netty (Ubuntu package) - addressed in versions 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1, 1:4.0.34-1ubuntu0.1~esm4, 1:4.1.7-4ubuntu0.1+esm6, 1:4.1.45-1ubuntu0.1~esm6, 1:4.1.48-4+deb11u2ubuntu0.1+esm3, 1:4.1.48-9ubuntu0.1+esm3, 1:4.1.48-16ubuntu0.1~esm2
Red Hat OpenShift Dev Spaces - update to 3.28.2
Red Hat Integration Camel Extensions for Quarkus - update to 3.33.2
netty-javadoc - update to 4.1.133-150200.4.46.1
netty - update to 4.1.133-150200.4.46.1

External References

Related Security Bulletins