Bug 2523094 (CVE-2026-76816)
| Summary: | CVE-2026-76816 io.netty/netty-codec-mqtt: Netty: MQTT validation bypass leading to message integrity issues | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | anujha, aschwart, asoldano, aszczucz, ataylor, bbaranow, bmaxwell, boliveir, bstansbe, csuconic, dbruscin, dlofthou, drichtar, ehugonne, fmariani, gmalinko, gtully, istudens, ivassile, iweiss, janstey, jsherman, jwon, kvanderr, mcarlett, mosmerov, mposolda, msvehla, nwallace, pberan, pdelbell, pesilva, pjindal, pmackay, rgemmell, rgodfrey, rmartinc, rstancel, rstepani, ssilvert, sthorger, tbish, tcunning, thjenkin, tlavocat, vdosoudi, vmuzikar, yfang |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Netty. The `MqttEncoder` component does not properly validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding. This allows an attacker to inject prohibited null bytes into MQTT (Message Queuing Telemetry Transport) UTF-8 string fields when an application uses Netty's MQTT encoder with user-controlled input. This could lead to routing, access-control, or identity mismatches in downstream brokers, potentially impacting the integrity of message handling.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-08-24 20:01:38 UTC
|