5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44248

CVE-2026-44248: Netty: Resource exhaustion in MqttDecoder

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44248

CVE-2026-44248:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-codec-mqtt	maven	>= 4.2.0.Alpha1, <= 4.2.12.Final	4.2.13.Final
io.netty:netty-codec-mqtt	maven	<= 4.1.132.Final	4.1.133.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-jfg9-48mv-9qgx, is an uncontrolled resource consumption flaw in Netty's MQTT codec. The root cause lies in the io.netty.handler.codec.mqtt.MqttDecoder class. When decoding an MQTT message, the decoder would parse the variable header, including a potentially very large "Properties" section, before it checked the overall message size against the configured maxBytesInMessage limit.

An attacker could exploit this by crafting an MQTT message with a small payload but an extremely large set of properties in the header. This would trigger two issues:

Memory Exhaustion: The decodeProperties method would be called to parse these properties, leading to the allocation of a large amount of memory to buffer them.
CPU Exhaustion: Because MqttDecoder extends ReplayingDecoder, if the malicious properties section was sent in chunks, the decoder would enter a loop, repeatedly re-parsing the buffered data until the complete section was received, causing high CPU utilization.

The patch addresses this in two key places:

In the decode method, the logic is changed to catch Signal exceptions thrown by the ReplayingDecoder. If a signal is caught (indicating more data is needed) and the amount of data already buffered exceeds maxBytesInMessage, the decoder now immediately throws a TooLongFrameException instead of continuing to buffer and parse.
In the decodeProperties method, a new check is added to verify that the buffer contains the complete properties block (as indicated by its length field) before attempting to parse it. If the data is incomplete, it triggers a replay signal efficiently, preventing the CPU-intensive loop of re-parsing the incomplete data.

Therefore, the key functions that would appear in a runtime profile during exploitation are io.netty.handler.codec.mqtt.MqttDecoder.decode and io.netty.handler.codec.mqtt.MqttDecoder.decodeProperties. These functions are directly involved in processing the malicious input and were modified in the security patch to enforce resource limits correctly.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44248: Netty: Resource exhaustion in MqttDecoder

CVE-2026-44248:

5.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Technical Details

Basic Information

Basic Information

5.3

5.3

CVE-2026-44248: Netty: Resource exhaustion in MqttDecoder

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

5.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44248: Netty: Resource exhaustion in MqttDecoder

CVE-2026-44248:

5.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Basic Information

Basic Information

5.3

5.3

CVE-2026-44248: Netty: Resource exhaustion in MqttDecoder

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI