The vulnerability arises from Netty's MQTT decoder where the check for packet size only validates the Remaining Length against a maximum allowed size but does not validate the Properties Length within the packet. Specifically, in the decodeProperties() method, the decoder attempts to parse the number of bytes indicated by Properties Length without ensuring it is within the Remaining Length. An attacker can exploit this by sending a CONNECT packet with a small Remaining Length but an extremely large Properties Length, causing the decoder to buffer and parse millions of UserProperty objects. This leads to excessive resource consumption and an OutOfMemoryError, resulting in denial of service.

An unauthenticated remote attacker can exploit this vulnerability to cause excessive CPU and memory consumption on the affected system, leading to an OutOfMemoryError and denial of service. There is no impact on confidentiality or integrity according to the CVSS vector. The attack requires no privileges or user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory URL is provided for updates. Until a fix is available, consider network-level protections to limit exposure to untrusted MQTT clients. No official fix or patch links are currently provided.