Improper input validation in Netty
CVE-2026-76816
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and potentially causing routing, access-control, or identity mismatches in downstream brokers. The vulnerability is exploitable when an application uses Netty's MQTT encoder to construct messages from user-controlled input. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Netty — versions < 4.1.137.Final, >= 4.2.0.Final, < 4.1.137.Final
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-76816?
- CVE-2026-76816 is a low-severity vulnerability in Netty, classified under Improper Input Validation. CVSS score: 3.5/10. Published 2026-08-24.
- How severe is CVE-2026-76816?
- Low severity. CVSS v3 base score is 3.5 out of 10.