CVE-2026-93575

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.

Summary

Netty's fix for CVE-2026-44248 is incomplete. The decoder checks if the MQTT packet's Remaining Length exceeds maxBytesInMessage, but fails to validate the Properties Length against the Remaining Length. An attacker can bypass the size limit by sending a small Remaining Length but an enormous Properties Length. This forces Netty to buffer and parse millions of properties, allowing an unauthenticated remote attacker to trigger excessive memory and CPU consumption, leading to OutOfMemoryError.

Details

In io.netty.handler.codec.mqtt.MqttDecoder, the decodeProperties() helper method reads totalPropertiesLength and attempts to parse that many bytes. If the buffer lacks the full length, a Signal is thrown. The catch block inside decode() only enforces maxBytesInMessage against bytesRemainingBeforeVariableHeader (the packet's Remaining Length).

By sending a CONNECT packet with a small Remaining Length but a huge Properties Length, the size check passes. ReplayingDecoder then buffers data from the network until the huge Properties Length is reached, parsing millions of UserProperty objects and exhausting CPU and memory.

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.

These are all security issues fixed in the netty-4.1.138-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issues:

• CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler (bsc#1275501).
• CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite (bsc#1275500).
• CVE-2026-62243: TLS hostname verification bypass in Netty OpenSSL client path (bsc#1276455).
• CVE-2026-62380: null byte and CRLF injection in Socks4ClientEncoder and Socks5ClientEncoder (bsc#1276456).
• CVE-2026-75595: fragmented TLS ClientHello causes fallback to default SslContext and allows for SNI routing and mTLS requirement bypass (bsc#1276420).
• CVE-2026-75596: fragmented ClientHellorecords can trigger quadratic pre-handshake reassembly in default SNI parsing (bsc#1276421).
• CVE-2026-76816: missing input validation in MqttEncoder allows for null-byte injection, topic hijacking, and ACL bypassing (bsc#1277243).
• CVE-2026-89044: HTTP request smuggling in Netty via improper validation of final Transfer-Encoding coding (bsc#1280048).
• CVE-2026-93488: Denial of Service via unbounded concurrent SPDY streams (bsc#1282084).
• CVE-2026-93491: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (bsc#1282085).
• CVE-2026-93492: HTTP/2 HpackEncoder DoS with large table size (bsc#1282132).
• CVE-2026-93493: missing nextUpdate field in OCSP responses leads to silent validation bypass (bsc#1281431).
• CVE-2026-93494: ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated (bsc#1282506).
• CVE-2026-93558: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (bsc#1282140).
• CVE-2026-93560: STOMP codec content-length long-to-int truncation causes infinite decode loop DoS (bsc#1282141).
• CVE-2026-93562: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282362).
• CVE-2026-93563: unbounded multi-line response accumulation in SmtpResponseDecoder leads to memory exhaustion and a DoS (bsc#1281432).
• CVE-2026-93564: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (bsc#1282363).
• CVE-2026-93565: RtspDecoder Method-Token Smuggling via Trailing Control Byte (bsc#1282364).
• CVE-2026-93566: HTTP Request Smuggling due to control characters in the chunk-size line (bsc#1282366).
• CVE-2026-93567: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (bsc#1282367).
• CVE-2026-93568: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (bsc#1282370).
• CVE-2026-93569: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (bsc#1282372).
• CVE-2026-93572: multiplication of patched preallocation limits in RedisArrayAggregator nested RESP headers can lead to denial of service (bsc#1281433).
• CVE-2026-93573: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282373).
• CVE-2026-93574: HTTP request smuggling via post-digit whitespace in chunk-size parsing (bsc#1282374).
• CVE-2026-93575: missing validations in the MqttDecoder can lead to excessive resource consumption and a DoS (bsc#1281434).
• CVE-2026-93576: netty-codec-smtp -- SMTP command-name field is not CRLF-validated (bsc#1282507).
• CVE-2026-93578: missing Extended Key Usage (EKU) check in OCSP client allows certificate revocation bypass (bsc#1281435).
• CVE-2026-93579: HTTP/2 header field values are not validated by default (bsc#1282378).

Changes for netty:

• Upgrade to upstream version 4.1.138

Changes for netty-tcnative:

• Upgrade to version 2.0.84 Final