Input validation error in Netty - CVE-2026-76816
Published: August 8, 2026 / Updated: August 25, 2026
Vulnerability identifier: #VU141323
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76816
CWE-ID: CWE-20
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass topic or client identifier validation.
The vulnerability exists due to improper input validation in io.netty.handler.codec.mqtt.MqttEncoder when encoding MQTT topic names, client IDs, usernames, and passwords as UTF-8 strings. A remote user can supply crafted MQTT string values containing prohibited characters to bypass topic or client identifier validation.
Exploitation requires an application to use Netty's MQTT codec-mqtt support with user-controlled input in MQTT string fields.
Affected software
Netty
How to mitigate CVE-2026-76816
Install security update from vendor's website.
Netty - addressed in versions 4.1.137, 4.2.17