Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.netty:netty-codec-mqtt

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3MavenPublished

    Netty MQTT: Resource exhaustion in MqttDecoder

    CVE-2026-44248 · GHSA-jfg9-48mv-9qgx

    Affected
    • Maven io.netty:netty-codec-mqtt >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final
    Fixed in
    4.2.13.Final4.1.133.Final· Vendor fix available
    Issue
    Impact The MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. Resources ANT-2026-09608 https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html#Toc3901027

    Recommended action: Upgrade to 4.2.13.Final or 4.1.133.Final by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →