Loading story…
Netty corrected an MQTT decoder regression introduced during remediation for CVE-2026-44248, after the library began incorrectly rejecting valid fragmented or batched MQTT packets with TooLongFrameException. The flaw came from using readableBytes() inside a ReplayingDecoder path, where the value reflected the cumulation buffer or an effectively unbounded readable size instead of the current packet’s declared remaining length during variable-header replay handling. The project fixed the logic in pull request #16787 by basing the size check on bytesRemainingBeforeVariableHeader and added regression tests covering both valid in-limit packets and oversized packets.
The fix was merged into the 4.2 branch for release in 4.2.14.Final, then auto-ported to 4.1 in #16838 and later re-applied in #16916 after a subsequent security merge reintroduced the broken code. Netty also addressed a related ReplayingDecoder readableBytes() issue in #16813 and auto-port #16919, ensuring early replay handling works correctly for incomplete MQTT properties blocks. Downstream projects including ArcadeDB and ThingsBoard referenced or adopted the updated Netty releases to resolve the decoder behavior.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Netty merged pull request #16916 into the 4.1 branch to re-apply the MQTT decoder size-check fix after a later CVE-2026-44248 security merge reintroduced the broken readableBytes()-based logic. The change restored use of the MQTT fixed-header remaining length so incomplete chunked variable headers replay correctly while genuinely oversized messages are still rejected.
Netty applied the MQTT decoder size-check correction to its 4.1 branch, addressing a replay-related bug where trailing packets in the cumulation buffer could incorrectly influence oversized-message detection. The commit also added unit tests covering incomplete PUBLISH variable headers and genuinely oversized packets.
Netty merged a fix for an MQTT decoder regression where an early-REPLAY check in decodeProperties did not work under ReplayingDecoder because readableBytes() returned a synthetic large value. The change switched to a getByte() probe at the end of the properties block so incomplete chunked properties correctly trigger replay without advancing the reader index.
Netty corrected an MQTT decoder regression introduced while addressing CVE-2026-44248, changing the size check to use bytesRemainingBeforeVariableHeader instead of readableBytes() in a ReplayingDecoder context. The fix was merged via pull request #16787 and slated for release in Netty 4.2.14.Final, with regression tests added for valid and oversized packets.
A GitHub issue reported that the fix for CVE-2026-44248 appeared to break MQTT decoding, causing incorrect aborts when multiple MQTT packets were present in the same buffer after upgrading Netty. The reporter tied the problem to comparing initialAvailableBytes against maxBytesInMessage instead of using bytesRemainingBeforeVariableHeader and observed failing Apache Artemis integration tests.
Netty committed changes to its MQTT decoder to better handle malformed, incomplete, or oversized inputs. The patch added logic to convert replay conditions into TooLongFrameException when the configured maximum message size had already been reached and introduced an early replay trigger during MQTT property decoding.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceredirect.github.com
Open sourceredirect.github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Netty fixed a QUIC race condition in `QuicheQuicChannel` that could notify a close promise before pending writes had completed, allowing a parent socket to close while data was still in flight. In affected cases, especially with pending `SENDMSG` operations on `io_uring`, the remote peer could miss the QUIC `CONNECTION_CLOSE` frame, leading to improper connection shutdown behavior. The fix, tracked under issue `#16718` and merged through pull request `#16758`, changes shutdown handling to ensure writes finish before close notification is delivered. Netty also added a unit test that simulates delayed writes and the raced close path, and shipped the correction in **Netty 4.2.14.Final**; downstream projects including ArcadeDB subsequently updated dependencies to consume the patched release.
Jun 29, 2026
Netty released **4.1.135.Final** and **4.2.15.Final** to patch a large batch of security vulnerabilities across core networking components, with fixes spanning `netty-resolver-dns`, `netty-codec-http2`, `netty-handler`, `netty-codec-redis`, `netty-codec-haproxy`, native transports, and SCTP support. The DNS resolver fixes address multiple cache-poisoning paths, including predictable transaction IDs combined with a static UDP source port, missing bailiwick checks for **CNAME** records, and insufficient validation of **NS** records; one of those issues was later tracked as **CVE-2026-45674**. Netty also fixed a TLS flaw in which wrapping a plain `X509TrustManager` could silently disable hostname verification for clients, and an IPv6 access-control bypass in `IpSubnetFilterRule`, later assigned **CVE-2026-44249**.
Jun 29, 2026
Netty merged fixes to limit memory allocation in its Brotli and Zstandard HTTP decompression paths after identifying denial-of-service risks from attacker-controlled compressed input. One change passes `HttpContentDecompressor`'s `maxAllocation` setting to `BrotliDecoder` and `ZstdDecoder`, bringing them in line with gzip and zlib handling and reducing exposure to zip-bomb-style memory exhaustion in constrained environments. A second change adds a `maxWindowLog` parameter to `ZstdDecoder` so oversized Zstandard frames can be rejected before large native-memory allocations occur. The Zstandard issue stemmed from `libzstd` allocating memory based on a frame's declared window size before decoding, allowing a small malicious frame to force large per-stream allocations and potentially crash servers. Netty set `DEFAULT_MAX_WINDOW_LOG = 27`, validated configurable values in the range `10` to `31`, merged the changes into the 4.2 branch, and ported them to 4.1 and 5.0. The protections shipped in **Netty 4.2.15.Final**, alongside other security fixes, and downstream projects including **Apache Spark** and **ArcadeDB** moved to upgrade to consume the release.
Jun 29, 2026