CVE-2026-76816

Netty: MQTT Topic Name and Client ID Validation Bypass

State: Published
Severity: 3.5 Low
Published: Aug 24, 2026
Updated: Aug 25, 2026
Reserved: Aug 19, 2026

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and potentially causing routing, access-control, or identity mismatches in downstream brokers. The vulnerability is exploitable when an application uses Netty's MQTT encoder to construct messages from user-controlled input. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Scores

CVSS	Score	Vector	Source
3.1	3.5 Low	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	GitHub_M

Weaknesses

CWE-20 Improper Input Validation
CWE-626 Null Byte Interaction Error (Poison Null Byte)

Affected Products

Product	Versions
nettynetty	>= 4.2.0.Final, < 4.1.137.FinalAffected < 4.1.137.FinalAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.