Denial of Service Vulnerability in Netty MQTT Decoder by JBoss
CVE-2026-93575

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat AMQ Broker 7
Red Hat Build Of Apache Camel For Spring Boot 4
Red Hat Fuse 7
Red Hat Jboss Enterprise Application Platform 7
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93575?

The vulnerability in JBoss's Netty MQTT decoder stems from an incomplete fix for a previous issue. It allows an unauthenticated attacker to craft a malicious MQTT packet with a small 'Remaining Length' while specifying an oversized 'Properties Length'. This oversight leads to excessive memory consumption and CPU usage as the MQTT decoder attempts to buffer and process an overwhelming number of properties. Consequently, systems may experience crashes or significant performance degradation due to OutOfMemoryError. Organizations utilizing affected versions of Netty should prioritize applying appropriate patches and updates to safeguard against potential exploitation.

References

https://access.redhat.com/security/cve/CVE-2026-93575
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536967
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.