Netty CVE-2026-44248

Patch available per vendor advisory: upgrade netty-codec-mqtt to the fixed Netty release identified in GHSA-jfg9-48mv-9qgx (https://github.com/netty/netty/security/advisories/GHSA-jfg9-48mv-9qgx); the exact fixed version was not included in the provided data, so confirm it against that advisory and bump the io.netty:netty-codec-mqtt dependency (and any transitive pull-in) accordingly. Until upgraded, compensating controls focus on bounding untrusted input: place the MQTT endpoint behind a network proxy or firewall that caps inbound packet/frame size and connection rate so oversized Properties sections are rejected before reaching the decoder (trade-off: a proxy that does not understand MQTT framing may not reliably size-limit a single logical packet); restrict MQTT listener exposure to trusted networks or require TLS client authentication / network ACLs to remove unauthenticated reachability (trade-off: breaks anonymous or public broker use cases); and constrain JVM heap plus add resource monitoring/auto-restart so a memory spike degrades gracefully rather than crashing silently (trade-off: this mitigates symptoms, not the underlying unbounded parsing). Note that the codec's own maxBytesInMessage setting does NOT mitigate this issue because the Properties section is parsed before that check.