Bug#1144384: netty: CVE-2026-56818 CVE-2026-73507 CVE-2026-73508

[Salvatore Bonaccorso]

Source: netty
Version: 1:4.1.48-16
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for netty.

CVE-2026-56818[0]:
| Netty is an asynchronous, event-driven network application
| framework. Prior to 4.1.136.Final and 4.2.16.Final, the
| RedisArrayAggregator Redis codec clears retained partial aggregate
| state when the maxNestedArrayDepth limit is exceeded, but it does
| not clear the same state when the sibling maxElements limit is
| exceeded. A peer can start a valid RESP array, send a bulk string
| child, then send a nested array header longer than the configured
| maxElements. Netty throws a decoder exception in
| decodeRedisArrayHeader, but the existing partial aggregate remains
| retained in the handler. If the application leaves the channel alive
| after the exception, later messages are still consumed into the pre-
| error aggregate, allowing an unauthenticated peer to keep attacker-
| controlled aggregate state alive across a security-limit exception
| and pin retained pooled buffers. This issue is fixed in versions
| 4.1.136.Final and 4.2.16.Final.


CVE-2026-73507[1]:
| Netty is an asynchronous, event-driven network application
| framework. Prior to 4.1.136.Final and 4.2.16.Final,
| io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to
| preserve closing-tag parser state across invocations, so an
| unauthenticated remote attacker could trickle-feed repeated </
| sequences that repeatedly rescanned the accumulated buffer and
| exhausted an EventLoop thread's CPU, causing denial of service with
| a maxFrameLength of 1 MB. This issue is fixed in versions
| 4.1.136.Final and 4.2.16.Final.


CVE-2026-73508[2]:
| Netty is an asynchronous, event-driven network application
| framework. Prior to 4.1.136.Final and 4.2.16.Final,
| io.netty.handler.codec.dns.AbstractDnsRecord,
| io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(),
| and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName()
| failed to release retained or newly allocated ByteBuf objects when
| IDN.toASCII() or encodeDomainName() rejected a malformed domain
| name, allowing unauthenticated remote DNS packets to leak direct
| memory incrementally until denial of service. This issue is fixed in
| versions 4.1.136.Final and 4.2.16.Final.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-56818
    https://www.cve.org/CVERecord?id=CVE-2026-56818
[1] https://security-tracker.debian.org/tracker/CVE-2026-73507
    https://www.cve.org/CVERecord?id=CVE-2026-73507
[2] https://security-tracker.debian.org/tracker/CVE-2026-73508
    https://www.cve.org/CVERecord?id=CVE-2026-73508

Regards,
Salvatore