Executive brief
Netty is a network application framework widely used to build scalable, real-time communication systems. The MQTT encoder component failed to validate input fields, allowing attackers to inject null bytes into MQTT message fields. This could cause downstream MQTT brokers to misroute messages, bypass access controls, or confuse client identity checks, potentially exposing messages to unauthorized recipients or causing service disruption.
Technical details
The vulnerability is an input validation flaw in the MqttEncoder class that fails to validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, permitting null bytes in MQTT UTF-8 string fields. The attack vector is network-based and requires that an application uses Netty's MQTT encoder to construct messages from user-controlled input. An attacker can craft MQTT messages with embedded null bytes in string fields, which may be improperly parsed by downstream brokers, leading to message routing bypasses, access control mismatches, or identity spoofing. The vulnerability is fixed in Netty versions 4.1.137.Final and 4.2.17.Final, which add encoding-side validation to reject fields containing NUL bytes.
Affected products
- Netty Netty before 4.1.137.Final and before 4.2.17.Final
Timeline
- 2026-08-24: disclosed: CVE-2026-76816 published
- 2026-08-06: patched: Patch merged in Netty (commit 9e05192), versions 4.1.137.Final and 4.2.17.Final