EUVD-2026-65093Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Adjacent vector because exploitation requires network access to the Netty application; PR:L because MQTT session establishment constitutes low-privilege access before crafted fields can be submitted; no confidentiality or availability impact applies.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and potentially causing routing, access-control, or identity mismatches in downstream brokers. The vulnerability is exploitable when an application uses Netty's MQTT encoder to construct messages from user-controlled input. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
AnalysisAI
Null byte injection in Netty's MqttEncoder affects applications using versions prior to 4.1.137.Final and 4.2.17.Final that forward user-controlled input into MQTT UTF-8 string fields - specifically client identifiers, will topics, usernames, and PUBLISH topic names. Because the encoder performs no null byte validation, an attacker with adjacent-network access and low-level privileges can embed the prohibited U+0000 character, causing downstream MQTT brokers to misparse field boundaries and potentially bypass topic-based ACLs or misidentify client sessions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses Netty's MqttEncoder (io.netty:netty-codec-mqtt) to construct MQTT messages and that at least one of the relevant fields - client identifier, will topic, username, or PUBLISH topic name - is populated from user-controlled input without prior null byte sanitization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.5 base score accurately reflects the constrained exploitation scenario: adjacent-network vector (AV:A), low privileges required (PR:L), and limited integrity impact (I:L) with no confidentiality or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with adjacent network access authenticates to an MQTT-enabled application built on Netty - such as an IoT gateway or broker bridge - and submits a CONNECT packet with a client identifier containing an embedded null byte (e.g., 'legit-client\x00admin'). Netty's MqttEncoder forwards the string without validation, and when the downstream broker's C-based MQTT library processes the field, it terminates parsing at the null byte, matching the message against ACL entries for a different client identity and granting unintended access or routing. … |
| Remediation | Upgrade to Netty 4.1.137.Final or 4.2.17.Final, which introduce null byte validation in MqttCodecUtil for all MQTT UTF-8 string fields, as confirmed by commits 1b5abc6443b63726c72cdd285af2feb7ddbb8ff7 and 9e0519239108a69b7e9bbc5e9182ee139a0d7961 and the vendor advisory at https://github.com/netty/netty/security/advisories/GHSA-43fm-7cxg-hf3j. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today