PT-2026-95357 · Netty · Netty
CVE-2026-93575
·
Published
2026-09-18
·
Updated
2026-09-29
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Netty versions prior to 4.1.138-1.1
Description
A flaw in the
MqttDecoder allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending a specially crafted MQTT CONNECT packet. The decoder does not properly validate the Properties Length against the Remaining Length, which enables the bypass of size limits. This results in excessive CPU and memory consumption, leading to an OutOfMemoryError.Recommendations
Update to version 4.1.138-1.1.
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Netty