CVE-2026-76816: Netty MQTT Encoder Information Disclosure

CVE-2026-76816 Overview

CVE-2026-76816 is an input validation vulnerability [CWE-20] in the Netty asynchronous, event-driven network application framework. The flaw resides in MqttEncoder, which does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding. This allows prohibited null bytes to appear in MQTT UTF-8 string fields. Downstream MQTT brokers processing these malformed messages can experience routing, access-control, or identity mismatches. The issue affects Netty versions prior to 4.1.137.Final and 4.2.17.Final and is exploitable when an application uses Netty's MQTT encoder to build messages from user-controlled input.

Critical Impact
Attackers on an adjacent network can inject null bytes into MQTT UTF-8 string fields, causing routing and access-control mismatches at downstream brokers.

Affected Products

Netty framework versions prior to 4.1.137.Final
Netty framework versions prior to 4.2.17.Final
Applications using Netty codec-mqttMqttEncoder with user-controlled input

Discovery Timeline

2026-08-24 - CVE-2026-76816 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-76816

Vulnerability Analysis

The vulnerability originates in Netty's codec-mqtt module. MqttEncoder writes MQTT UTF-8 string fields for four inputs: client identifiers, will topics, usernames, and PUBLISH topic names. The MQTT specification prohibits the null character (U+0000) in these fields. Netty did not enforce this restriction before encoding.

An attacker who controls any of these fields can embed a null byte inside a valid-looking UTF-8 string. When the resulting frame reaches a downstream broker, the broker and its authorization layer may interpret the string differently. That divergence produces topic routing errors, ACL bypass, or identity confusion between session and authorization state.

The vulnerability requires an application to pass untrusted input directly to the encoder. It does not affect Netty's MQTT decoder path.

Root Cause

MqttCodecUtil.isValidPublishTopicName and related validation helpers rejected wildcard characters (#, +) but did not reject the null character. Null client IDs and topic strings were also accepted. The encoder emitted these values without normalization, producing frames that violate the MQTT UTF-8 string contract.

Attack Vector

Exploitation requires an application that constructs MQTT messages from user-controlled input and forwards them to a broker. The attacker submits input containing an embedded \0 byte through the application's normal interface. Netty encodes the tainted string, and the receiving broker's parser or ACL engine mishandles it, producing an identity or authorization mismatch.

java

// Netty patch: codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttCodecUtil.java
static boolean isValidPublishTopicName(String topicName) {
    if (topicName == null) {
        return false;
    }
    // publish topic name must not contain any wildcard
    for (int i = 0; i < topicName.length(); i++) {
        char c = topicName.charAt(i);
        if (c == '#' || c == '+' || c == '\0') {
            return false;
        }
    }
}
// Source: https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961

The patch adds a null check on the topic name and rejects the null character alongside the existing wildcards.

Detection Methods for CVE-2026-76816

Indicators of Compromise

MQTT frames containing 0x00 bytes inside client identifier, will topic, username, or PUBLISH topic name fields.
Broker logs showing topic-routing errors or ACL denials that do not correspond to the client-reported topic string.
Session identity mismatches between authentication logs and subsequent authorization decisions.

Detection Strategies

Parse MQTT CONNECT and PUBLISH frames at the network boundary and flag UTF-8 string fields containing U+0000.
Inventory Java services depending on io.netty:netty-codec-mqtt versions earlier than 4.1.137.Final or 4.2.17.Final.
Compare authenticated client identifiers in broker logs against downstream authorization identifiers to detect divergence.

Monitoring Recommendations

Alert on broker rejection rates or malformed-frame counters increasing after deployment of upstream clients.
Log full raw byte sequences of MQTT string fields for post-hoc analysis when null-byte anomalies appear.
Monitor application logs for encoder exceptions after upgrading to the patched Netty versions.

How to Mitigate CVE-2026-76816

Immediate Actions Required

Upgrade Netty to 4.1.137.Final or 4.2.17.Final in all affected services.
Audit application code paths that pass user input to MqttEncoder and add server-side validation for null bytes.
Enforce broker-side rejection of MQTT frames containing null characters in UTF-8 string fields.

Patch Information

The fix is included in Netty 4.1.137.Final and 4.2.17.Final. See the GitHub Security Advisory GHSA-43fm-7cxg-hf3j and the Netty commit fix. The change to MqttCodecUtil adds validation for null topic names and rejects the \0 character in publish topic names.

Workarounds

Sanitize all user-controlled strings before passing them to Netty's MQTT encoder by stripping or rejecting the \0 character.
Restrict network reachability of MQTT services to trusted adjacent networks until the patch is deployed.
Apply broker-side policies that drop MQTT messages whose UTF-8 string fields contain U+0000.

bash

# Maven: pin Netty codec-mqtt to a patched release
mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.1.137.Final
mvn -DskipTests dependency:tree | grep netty-codec-mqtt