CVE-2026-93575: Netty MqttDecoder DoS Vulnerability

CVE-2026-93575 Overview

A flaw in the Netty framework's MqttDecoder allows unauthenticated remote attackers to trigger denial of service (DoS) conditions in applications that process MQTT traffic. The decoder does not properly validate the Properties Length field against the Remaining Length in an MQTT CONNECT packet. Attackers can send a specially crafted CONNECT packet to bypass size limits, driving excessive memory and CPU consumption until the Java Virtual Machine throws an OutOfMemoryError. The weakness is tracked under CWE-1035 and affects Netty-based MQTT broker and client implementations.

Critical Impact
An unauthenticated network attacker can crash any Netty-based MQTT service with a single malformed CONNECT packet, disrupting IoT messaging, telemetry, and event pipelines.

Affected Products

Netty framework (io.netty:netty-codec-mqtt) MQTT codec module
Applications and brokers embedding Netty's MqttDecoder for MQTT protocol handling
Red Hat products that ship or depend on the Netty MQTT codec (see Red Hat CVE-2026-93575)

Discovery Timeline

2026-09-18 - CVE-2026-93575 published to the National Vulnerability Database
2026-09-25 - Record last modified in NVD database

Technical Details for CVE-2026-93575

Vulnerability Analysis

The vulnerability resides in Netty's MQTT CONNECT packet decoder. The MQTT 5 CONNECT variable header contains a Properties Length field that describes the byte length of the properties block that follows. MqttDecoder reads this length and allocates buffers to parse the properties, but it does not cross-check the declared value against the packet's outer Remaining Length field.

When the attacker declares a Properties Length larger than the actual data remaining in the packet, the decoder proceeds to allocate and process memory based on the attacker-controlled value. This causes the Java heap to expand rapidly and CPU cycles to be consumed on decode operations that will never complete. Sustained delivery of these packets, or a single sufficiently oversized packet, leads to an OutOfMemoryError and process termination.

Root Cause

The root cause is missing input validation between two related length fields in the MQTT protocol frame. Netty accepts the Properties Length value at face value rather than bounding it by the number of bytes still available inside Remaining Length. This is an instance of CWE-1035, Using Components with Known Vulnerabilities, applied here as improper validation of a length prefix within a nested protocol structure.

Attack Vector

Exploitation requires network reachability to the MQTT listener and no authentication, because MQTT CONNECT is the very first packet in the protocol handshake. An attacker crafts a CONNECT packet where the Properties Length varint is inflated well beyond the packet's real properties section. The attacker sends the packet to the target broker or client, and the decoder attempts to reserve and process the inflated properties buffer. Repeated packets accelerate memory pressure and force the JVM into an OutOfMemoryError, halting message processing for all connected clients.

No verified public exploit code is available at the time of publication. Technical details are described in prose only — see the Red Hat Bug Report #2536967 for further analysis.

Detection Methods for CVE-2026-93575

Indicators of Compromise

MQTT broker or client processes terminating with java.lang.OutOfMemoryError referencing io.netty.handler.codec.mqtt in stack traces
Sudden Java heap growth on MQTT listener processes shortly after inbound TCP connections on port 1883 or 8883
CONNECT packets whose declared Properties Length exceeds the packet's Remaining Length field

Detection Strategies

Deploy MQTT-aware network inspection that parses CONNECT packets and flags mismatches between Properties Length and Remaining Length
Add JVM monitoring rules that alert on repeated OutOfMemoryError events in processes hosting Netty's MQTT codec
Correlate abnormal MQTT connection churn with heap and garbage collection spikes on broker nodes

Monitoring Recommendations

Track inbound MQTT connection rates per source IP and alert on bursts targeting the listener
Enable verbose Netty codec logging in staging to capture malformed CONNECT decode failures
Forward JVM metrics and MQTT broker logs to a centralized analytics platform for anomaly detection

How to Mitigate CVE-2026-93575

Immediate Actions Required

Inventory all Java services that depend on io.netty:netty-codec-mqtt, including transitive dependencies pulled in by MQTT brokers, IoT gateways, and messaging libraries
Restrict network exposure of MQTT listeners to trusted client networks until patched versions are deployed
Enable rate limiting and connection quotas on MQTT ports to blunt repeated exploitation attempts

Patch Information

Refer to the Red Hat CVE-2026-93575 advisory for the list of fixed Netty versions and affected Red Hat product streams. Upgrade netty-codec-mqtt to the fixed release identified by upstream Netty maintainers and rebuild any application that shades or repackages the Netty codec.

Workarounds

Front the MQTT listener with a protocol-aware proxy that validates the relationship between Properties Length and Remaining Length and drops non-conforming CONNECT packets
Enforce a low maximum MQTT packet size at the ingress layer to reduce the memory impact of malformed frames
Require TLS with client certificate authentication at the network layer to limit unauthenticated exposure of the listener

bash

# Configuration example: enforce upstream Netty version at the build layer
# Maven dependency management snippet
# <dependencyManagement>
#   <dependencies>
#     <dependency>
#       <groupId>io.netty</groupId>
#       <artifactId>netty-codec-mqtt</artifactId>
#       <version>FIXED_VERSION</version>
#     </dependency>
#   </dependencies>
# </dependencyManagement>