Skip to main content

Uncontrolled Resource Consumption

CVE-2026-44248

High
7.5/10

Summary

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.133.Final and 4.2.x prior to 4.2.13.Final and 5.0.0.Alpha2, 5.0.0.Alpha2-redhat-2 and 5.0.0.Alpha2-redhat-3, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the "decodeVariableHeader()" method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The "decodeVariableHeader()" can call other methods which will call "decodeProperties()". Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-400 - Uncontrolled resource consumption

An uncontrolled resource allocation attack (also known as resource exhaustion attack) triggers unauthorized overconsumption of the limited resources in an application, such as memory, file system storage, database connection pool entries, and CPU. This may lead to denial of service for valid users and degradation of the application's functionality as well as that of the host operating system.

References

Advisory Timeline

  • Published