Executive brief
Netty is a widely used networking framework that helps developers build high-performance applications. A flaw in how it handles MQTT 5 messages allows an attacker to send specially crafted data that bypasses size limits, leading to excessive memory and CPU consumption. This can result in a denial-of-service (DoS) condition, making the affected application slow or completely unresponsive.
Technical details
A resource exhaustion vulnerability exists in Netty's MqttDecoder. The decodeVariableHeader() method is invoked before the message size limit check (bytesRemainingBeforeVariableHeader > maxBytesInMessage) is applied, allowing MQTT 5 header properties to be parsed and buffered without restriction. Furthermore, because MqttDecoder extends ReplayingDecoder, the framework may repeatedly re-parse large property sections if the full message has not yet arrived, compounding CPU and memory usage. This can be exploited by a remote attacker to cause a denial-of-service. The issue is resolved in versions 4.2.13.Final and 4.1.133.Final.
Affected products
- Netty netty-codec-mqtt <= 4.1.132.Final, <= 4.2.12.Final
Timeline
- 2026-05-13: advisory: NVD publication date
- 2026-05-05: disclosed: GitHub advisory published