AIKIDO-2026-629214
netty-codec-mqtt is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
netty-codec-mqttTL;DR
MqttDecoder, in an incomplete fix for CVE-2026-44248, validates the MQTT packet's Remaining Length against maxBytesInMessage but does not validate the MQTT 5 Properties Length against the Remaining Length. A CONNECT packet with a small Remaining Length but an enormous Properties Length bypasses the size check and forces the decoder to buffer and parse millions of properties. This drives excessive memory and CPU use and an OutOfMemoryError. The fix bounds the Properties Length against the remaining length.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application decodes MQTT packets from untrusted clients.
Background info
netty-codec-mqtt is vulnerable to Denial of Service (DoS) in versions 4.1.0.Final - 4.1.137.Final and 4.2.0.Final - 4.2.17.Final.
How to fix this
Upgrade the io.netty:netty-codec-mqtt library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.