Vulnerability in Netty MQTT Encoder Allows Malformed Message Handling
CVE-2026-76816

3.5LOW

Key Information:

Vendor

Netty

Status
Netty
Vendor
CVE Published:
24 August 2026

What is CVE-2026-76816?

The vulnerability in Netty's MQTT encoder arises from its failure to properly validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding. This lack of validation allows for the inclusion of null bytes in MQTT UTF-8 string fields, which can lead to routing problems, access-control issues, and identity mismatches in downstream brokers. This vulnerability is particularly exploitable when user-controlled input is used to construct messages. It is critical to update to Netty versions 4.1.137.Final or 4.2.17.Final to mitigate this risk.

Affected Version(s)

netty >= 4.2.0.Final, < 4.1.137.Final < 4.2.0.Final, 4.1.137.Final

netty < 4.1.137.Final < 4.1.137.Final

References

https://github.com/netty/netty/security/advisories/GHSA-4...
x_refsource_CONFIRM
https://github.com/netty/netty/commit/1b5abc6443b63726c72...
x_refsource_MISC
https://github.com/netty/netty/commit/9e0519239108a69b7e9...
x_refsource_MISC

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.