CVE-2026-44248Disclosure(netty / netty)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch netty netty systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

netty CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/netty/netty/security/advisories/GHSA-jfg9-48mv-9qgx

Other references

Weakness type (CWE)

CWE-400CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

netty

Threat summary

Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 1d ago at 3 mentions (2026-05-13); latest day: 1
5 total mentions across 3 days

Affected systems

Vendors

netty

Products

netty

Deep dive

Activity timeline5 mentions / 3d

Signal classification2 categories

Disclosure

480.0%

Patch

120.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-07	1	Disclosure1
2026-05-13	3	Disclosure3
2026-09-20	1	Patch1

Full discourse5 posts

DFIR Lab@DFIR_Lab19d
Patch
#CVE-2026-93575: CVSS 7.5 HIGH Netty MQTT decoder bypass allows unauthenticated remote attackers to trigger OutOfMemoryError via malformed Properties Length. Incomplete fix for CVE-2026-44248. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/yVsVhY7LhL
Post summary
The post reports a high-severity Netty MQTT decoder bypass that can cause OutOfMemoryError via malformed Properties Length and notes an incomplete prior fix. Its primary actionable takeaway is to patch immediately.
0000036
139 followersView on X
Infoflowcloud@infoflowcloud148d
Disclosure
🚨*CVE* CVE-2026-44248 Netty is an asynchronous, event-driven network application framework. Prior to http://4.2.13.Final and http://4.1.133.Final, the MQTT 5 header Properties section is parsed and buff… https://www.cve.org/CVERecord?id=CVE-2026-44248 ----- Traducció… http://infoflow.cloud`
Post summary
CVE-2026-44248 describes a buffer overflow vulnerability in Netty's MQTT 5 header parsing before specific releases, with no PoC, exploit, or patch details provided in the text.
0000025
77 followersView on X
CVE@CVEnew148d
Disclosure
CVE-2026-44248 Netty is an asynchronous, event-driven network application framework. Prior to http://4.2.13.Final and http://4.1.133.Final, the MQTT 5 header Properties section is parsed and buff… https://www.cve.org/CVERecord?id=CVE-2026-44248
Post summary
The text points to a CVE in Netty involving MQTT 5 header parsing for older versions but provides no detailed technical description, exploitation code, or patch guidance.
00000214
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds148d
Disclosure
CVE-2026-44248 Denial of Service via Unbounded MQTT Properties Parsing in Netty Before http://4.2.13.Final https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44248
Post summary
The post announces CVE‑2026‑44248, describing a denial‑of‑service flaw in Netty via unbounded MQTT property parsing affecting versions prior to 4.2.13. No exploit, patch, or PoC details are offered.
0000049
4.0K followersView on X
DailyCVE@dailycve154d
Disclosure
🟠 Netty, Resource exhaustion, #CVE-2026-44248 (Moderate) https://dailycve.com/netty-resource-exhaustion-cve-2026-44248-moderate/
Post summary
A moderate‑severity resource exhaustion flaw in Netty (CVE‑2026‑44248) is disclosed, but no PoC, exploit, patch, or active exploitation evidence is provided.
0000037
196 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	netty	netty	-	-	-

Explore more

Back to dashboard netty CVEs netty vulnerabilities

What researchers are saying

CVE-2026-44248

DFIR Lab[verified]@DFIR_LabPatch

The post reports a high-severity Netty MQTT decoder bypass that can cause OutOfMemoryError via malformed Properties Length and notes an incomplete prior fix. Its primary actionable takeaway is to patch immediately.

Infoflowcloud@infoflowcloudDisclosure

CVE-2026-44248 describes a buffer overflow vulnerability in Netty's MQTT 5 header parsing before specific releases, with no PoC, exploit, or patch details provided in the text.

CVE@CVEnewDisclosure

The text points to a CVE in Netty involving MQTT 5 header parsing for older versions but provides no detailed technical description, exploitation code, or patch guidance.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE‑2026‑44248, describing a denial‑of‑service flaw in Netty via unbounded MQTT property parsing affecting versions prior to 4.2.13. No exploit, patch, or PoC details are offered.

DailyCVE@dailycveDisclosure

A moderate‑severity resource exhaustion flaw in Netty (CVE‑2026‑44248) is disclosed, but no PoC, exploit, patch, or active exploitation evidence is provided.