Netty fixes MQTT decoder regression that rejected valid fragmented packets

Netty corrected an MQTT decoder regression introduced during remediation for CVE-2026-44248, after the library began incorrectly rejecting valid fragmented or batched MQTT packets with TooLongFrameException. The flaw came from using readableBytes() inside a ReplayingDecoder path, where the value reflected the cumulation buffer or an effectively unbounded readable size instead of the current packet’s declared remaining length during variable-header replay handling. The project fixed the logic in pull request #16787 by basing the size check on bytesRemainingBeforeVariableHeader and added regression tests covering both valid in-limit packets and oversized packets.

The fix was merged into the 4.2 branch for release in 4.2.14.Final, then auto-ported to 4.1 in #16838 and later re-applied in #16916 after a subsequent security merge reintroduced the broken code. Netty also addressed a related ReplayingDecoder readableBytes() issue in #16813 and auto-port #16919, ensuring early replay handling works correctly for incomplete MQTT properties blocks. Downstream projects including ArcadeDB and ThingsBoard referenced or adopted the updated Netty releases to resolve the decoder behavior.