Medium 5.3Published May 13, 2026

CVE-2026-44248Netty: Resource exhaustion in MqttDecoder

Updated under an hour ago (Oct 27, 2026, 1:30 PM ET)

Does this affect you?

It affects netty and 9 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for netty

Exploited in the last 30 days

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness (CWE): CWE-400, CWE-770
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Modified
Record last updated: Sep 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

netty netty netty:netty (from the name)	from 4.2.0.Alpha1, < 4.2.13.Final; before 4.1.133.Final	CNA record
io.netty netty-codec-mqtt io.netty:netty_codec_mqtt (from the name)	from 4.2.0.Alpha1, < 4.2.13.Final; before 4.1.133.Final	CNA record
Red Hat Red Hat AMQ Broker 7.13.6 redhat:amq_broker	from codec-mqtt not affected	CISA ADP
Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 redhat:apache_camel_spring_boot	from codec-mqtt not affected	CISA ADP
Red Hat Red Hat Data Grid 8.6.2 redhat:jboss_data_grid	from codec-mqtt not affected	CISA ADP
Red Hat Red Hat Fuse 7 redhat:jboss_fuse	7	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform 7 redhat:jboss_enterprise_application_platform	7	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack redhat:jbosseapxp	Versions not stated	CISA ADP
Red Hat Red Hat Process Automation 7 redhat:jboss_enterprise_bpms_platform	7	CISA ADP
Red Hat Red Hat Single Sign-On 7 redhat:red_hat_single_sign_on	7	CISA ADP
1–10 of 11

References

References

https://github.com/netty/netty/security/advisories/GHSA-jfg9-48mv-9qgx	x-refsource-confirm, vendor-advisory
https://access.redhat.com/errata/RHSA-2026:37390
https://access.redhat.com/errata/RHSA-2026:41951
https://access.redhat.com/errata/RHSA-2026:66488
https://access.redhat.com/errata/RHSA-2026:66545
https://access.redhat.com/security/cve/CVE-2026-44248
https://bugzilla.redhat.com/show_bug.cgi?id=2477231
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44248.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.