Ubuntu issues USN-8742-1 fixing a Netty DNS cache poisoning flaw caused by improper NS record bailiwick validation.
Ubuntu Security Notice USN-8742-1 addresses a vulnerability in the Netty framework in which NS records are incorrectly validated for bailiwick. An attacker could potentially exploit this to facilitate DNS cache poisoning attacks. Updated packages are available for supported Ubuntu releases.
Unauthenticated remote memory exhaustion in Apache Storm Worker 3.0.x Netty decoder fixed in 3.1.0, allowing pre-auth denial of service.
CVE-2026-82435 (rated important) affects Apache Storm Worker (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. The worker's Netty message decoder sits ahead of SASL authentication handlers and processes frames before any authentication occurs. It allocates buffers sized from an attacker-controlled length field, so a single frame from an unauthenticated peer reaching the worker can exhaust memory. Users must upgrade to 3.1.0.