CVE-2026-44248

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

• CWE-400
• CWE-770

• https://github.com/netty/netty/security/advisories/GHSA-jfg9-48mv-9qgxVendor Advisory
• https://access.redhat.com/errata/RHSA-2026:37390
• https://access.redhat.com/errata/RHSA-2026:41951
• https://access.redhat.com/security/cve/CVE-2026-44248
• https://bugzilla.redhat.com/show_bug.cgi?id=2477231
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44248.json

Published

May 13, 2026

Last Modified

Aug 3, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44242Micronaut Framework is a JVM-based full stack Java framework…3.7
• CVE-2026-44243GitPython is a python library used to interact with Git repo…7.1
• CVE-2026-44244GitPython is a python library used to interact with Git repo…7.8
• CVE-2026-44245Kyverno is a policy engine designed for cloud native platfor…6.1
• CVE-2026-44246nnU-Net is a semantic segmentation framework that automatica…7.2
• CVE-2026-44247Volcano is a Kubernetes-native batch scheduling system. Prio…7.4
• CVE-2026-44249Netty is a network application framework for development of …8.1
• CVE-2026-4425Rejected reason: Reserved for EastLink case, but no need for…
• CVE-2026-44250Netty is a network application framework for development of …7.5
• CVE-2026-44251Wazuh is a free and open source platform used for threat pre…6.5
• CVE-2026-44257efw4.X is an Enterprise Framework for Web. Prior to 4.08.010…9.3
• CVE-2026-44258efw4.X is an Enterprise Framework for Web. Prior to 4.08.010…9.3