CVE-2026-44248: Netty: Resource exhaustion in MqttDecoder
### Impact The MQTT 5 header Properties section is parsed and buffered _before_ any message size limit is applied. Specifically, in `MqttDecoder`, the `decodeVariableHeader()` method is called before the `bytesRemainingBeforeVariableHeader > maxBytesInMessage` check. The `decodeVariableHeader()` can call other methods which will call `decodeProperties()`. Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because `MqttDecoder` extends `ReplayingDecoder`, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. ### Resources `ANT-2026-09608` https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html#_Toc3901027
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44248?
CVE-2026-44248 has a high severity rating due to the potential for denial-of-service attacks by exploiting improper message size validation.
How do I fix CVE-2026-44248?
To remediate CVE-2026-44248, upgrade to version 4.1.133.Final or 4.2.13.Final of io.netty:netty-codec-mqtt.
What versions are affected by CVE-2026-44248?
CVE-2026-44248 affects versions io.netty:netty-codec-mqtt up to and including 4.1.132.Final and 4.2.12.Final.
What vulnerabilities does CVE-2026-44248 expose in application security?
CVE-2026-44248 exposes applications to potential denial-of-service attacks due to inadequate size checks during MQTT message parsing.
Is CVE-2026-44248 applicable to all MQTT implementations?
No, CVE-2026-44248 specifically pertains to the io.netty:netty-codec-mqtt library and its handling of MQTT 5 protocol messages.