Netty: Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names… (CVE-2026-76816)
Description
Netty versions prior to 4.1.137.Final and 4.2.17.Final contain a vulnerability in the MqttEncoder component where client identifiers, will topics, usernames, and PUBLISH topic names are not validated before encoding. This allows prohibited null bytes in MQTT UTF-8 string fields, potentially causing routing, access-control, or identity mismatches in downstream brokers. The issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
CVSS v3.1
Score 3.5low
Affected software
pkg:deb/ubuntu/netty?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/netty?arch=source&distro=esm-apps-legacy/xenialpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/netty?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/netty?arch=source&distro=stonkingpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Netty is an asynchronous, event-driven network application framework. In versions before 4.1.137.Final and 4.2.17.Final, the MqttEncoder does not validate MQTT UTF-8 string fields such as client identifiers, will topics, usernames, and PUBLISH topic names before encoding. This lack of validation permits prohibited null bytes in these fields, which can lead to routing, access-control, or identity mismatches in downstream MQTT brokers. The vulnerability is exploitable when applications use Netty's MQTT encoder to construct messages from user-controlled input. The issue is resolved in versions 4.1.137.Final and 4.2.17.Final.
Potential Impact
The vulnerability allows insertion of prohibited null bytes in MQTT UTF-8 string fields, which may cause routing, access-control, or identity mismatches in downstream brokers. This could lead to incorrect message routing or unauthorized access control decisions. The CVSS score is 3.5 (medium severity), indicating limited impact primarily on integrity without direct confidentiality or availability impact.
Mitigation Recommendations
Upgrade Netty to version 4.1.137.Final or later, or 4.2.17.Final or later, where this vulnerability is fixed. There is no indication that other mitigations are required beyond applying these official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-76816
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:26.10","Ubuntu:Pro:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ad3f5802cdf04f65666216d
Added to database: 10/17/2026, 22:24:00 UTC
Last enriched: 10/17/2026, 23:44:16 UTC
Last updated: 10/17/2026, 23:44:16 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.