Input validation error in Netty - #VU141323
Published: August 8, 2026
Vulnerability identifier: #VU141323
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass topic or client identifier validation.
The vulnerability exists due to improper input validation in io.netty.handler.codec.mqtt.MqttEncoder when encoding MQTT topic names, client IDs, usernames, and passwords as UTF-8 strings. A remote user can supply crafted MQTT string values containing prohibited characters to bypass topic or client identifier validation.
Exploitation requires an application to use Netty\'s MQTT codec-mqtt support with user-controlled input in MQTT string fields.
Affected software
Netty
Remediation
Install security update from vendor's website.
Netty - addressed in versions 4.1.137, 4.2.17