Is CVE-2026-76816 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76816 being exploited in the wild.

How severe is CVE-2026-76816?

Low severity, with a CVSS score of 3.5, published 24 August 2026.

Which products and versions are affected?

Netty before 4.1.137.Final and before 4.2.17.Final.

Is there a fix for CVE-2026-76816?

A patch was published on 2026-08-06: Patch merged in Netty (commit 9e05192), versions 4.1.137.Final and 4.2.17.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76816 attacked?

It is attacked over the network.

Am I affected by CVE-2026-76816?

Check whether you run Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76816: Netty MqttEncoder null byte injection in MQTT fields

CVE-2026-76816 · Severity: low · CVSS 3.5 · Published 2026-08-24

Netty is a network application framework widely used to build scalable, real-time communication systems. The MQTT encoder component failed to validate input fields, allowing attackers to inject null bytes into MQTT message fields. This could cause downstream MQTT brokers to misroute messages, bypass access controls, or confuse client identity checks, potentially exposing messages to unauthorized recipients or causing service disruption.

Technologies: Netty. Vendors: Netty.

Quick answers

Is CVE-2026-76816 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76816 being exploited in the wild.
How severe is CVE-2026-76816?: Low severity, with a CVSS score of 3.5, published 24 August 2026.
Which products and versions are affected?: Netty before 4.1.137.Final and before 4.2.17.Final.
Is there a fix for CVE-2026-76816?: A patch was published on 2026-08-06: Patch merged in Netty (commit 9e05192), versions 4.1.137.Final and 4.2.17.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76816 attacked?: It is attacked over the network.
Am I affected by CVE-2026-76816?: Check whether you run Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an input validation flaw in the MqttEncoder class that fails to validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, permitting null bytes in MQTT UTF-8 string fields. The attack vector is network-based and requires that an application uses Netty's MQTT encoder to construct messages from user-controlled input. An attacker can craft MQTT messages with embedded null bytes in string fields, which may be improperly parsed by downstream brokers, leading to message routing bypasses, access control mismatches, or identity spoofing. The vulnerability is fixed in Netty versions 4.1.137.Final and 4.2.17.Final, which add encoding-side validation to reject fields containing NUL bytes.

Affected products

Netty Netty before 4.1.137.Final and before 4.2.17.Final

Timeline

2026-08-24: disclosed: CVE-2026-76816 published
2026-08-06: patched: Patch merged in Netty (commit 9e05192), versions 4.1.137.Final and 4.2.17.Final

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.