CVE-2026-73508

CVE-2026-73508 exposes a resource leak in Netty's DNS codec where malformed internationalized domain names trigger a ByteBuf leak in the rejection path. The vulnerability is not triggered by successfully processing malicious input—it fires specifically when IDN.toASCII() or encodeDomainName() rejects malformed domain names. The ByteBuf has already been allocated before validation completes, but the rejection path fails to release it. This is a partial-parse rejection leak: the developer is mid-way through assembling a structure, validation fails, and the cleanup obligation is not obvious because ownership was never formally transferred at the validation boundary. The CVSS score of 5.3 materially understates operational risk. A ByteBuf leak causing gradual memory growth until OOM is categorically different from most medium-severity issues. An attacker can send a sustained stream of malformed DNS packets to a long-running Netty DNS server or forwarder, forcing memory exhaustion without triggering any visible alerts or logs. The leak accumulates silently until the service crashes—the temporal gap between first malicious packet and OOM is the real blast radius, and current risk frameworks do not model it. Audit the broader DnsCodecUtil and DefaultDnsRecordDecoder codebase for similar allocate-then-validate patterns. The CVE fixes three specific methods, but the underlying pattern of allocating before validating is structural. Sibling methods, deprecated overloads, or internal helpers that implement the same pattern may not have been in scope for this CVE. The fix requires backporting to 4.1.136.Final or 4.2.16.Final, and organizations on older branches face a compounding exposure window: low CVSS scores signal deprioritization to enterprise risk frameworks, extending the time production systems carry this leak unresolved. The EPSS of 0.00333 further reinforces deprioritization, making it likely that critical infrastructure will remain exposed for quarters.

Reviewed through automated stages and approved by a human before publication.