CVE catalog

CVE-2026-44248

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.56% · Oct 25, 2026

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannettysid1:4.1.48-16vulnerable
Debiannettyforky1:4.1.48-16vulnerable
Debiannettytrixie1:4.1.48-10+deb13u1vulnerable
Debiannettytrixie-security1:4.1.48-10+deb13u1vulnerable
Debiannettybookworm1:4.1.48-7+deb12u2vulnerable
Debiannettybookworm-security1:4.1.48-7+deb12u2vulnerable
CpenettyNot reportedNot reportedvulnerable
CpenettyNot reported4.1.133fixed
CpenettyNot reported4.2.13fixed
CpenettyNot reported4.2.13fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannettysourcesid(unfixed)not yet assignedNot reported[1136652]
Debiannettysourceforky(unfixed)not yet assignedNot reported[1136652]
Debiannettysourcetrixie(unfixed)not yet assignedNot reported[1136652]
Debiannettysourcebookworm(unfixed)not yet assignedNot reported[1136652]
CpenettycpeNot reported4.1.133Not reportedNot reportedNot reported
CpenettycpeNot reported4.2.13Not reportedNot reportedNot reported
CpenettycpeNot reported4.2.13Not reportedNVD-CVE-2026-44248Not reported

[Debian bug #1136652]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libnetty-java]Affected

    Source package: [netty]

    Details (4)

    • 1:4.1.48-7+deb12u2 · all · bookworm

      Affected

      nvd · netty · debian · bookworm; nvd · netty · debian · 12

    • 1:4.1.48-7+deb12u2 · all · bookworm

      Affected

      nvd · netty · debian · bookworm; nvd · netty · debian · 12

    • 1:4.1.48-7+deb12u2 · all · bookworm-security

      Affected

      nvd · netty · debian · bookworm; nvd · netty · debian · 12

    • 1:4.1.48-7+deb12u2 · all · bookworm-security

      Affected

      nvd · netty · debian · bookworm; nvd · netty · debian · 12

[Debian 13 (Trixie)]

  • [libnetty-java]Affected

    Source package: [netty]

    Details (4)

    • 1:4.1.48-10+deb13u1 · all · trixie

      Affected

      nvd · netty · debian · 13

    • 1:4.1.48-10+deb13u1 · all · trixie

      Affected

      nvd · netty · debian · 13

    • 1:4.1.48-10+deb13u1 · all · trixie-security

      Affected

      nvd · netty · debian · 13

    • 1:4.1.48-10+deb13u1 · all · trixie-security

      Affected

      nvd · netty · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]