CVE-2026-76816
Received Received - Intake

Null Byte Injection in Netty MQTT Encoder

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: GitHub, Inc.

Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and potentially causing routing, access-control, or identity mismatches in downstream brokers. The vulnerability is exploitable when an application uses Netty's MQTT encoder to construct messages from user-controlled input. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-25
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-76816
EUVD
EUVD-2026-65093

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
netty netty to 4.2.17.Final (exc)
netty netty 4.2.0.Final
netty netty 4.2.16.Final
netty netty 4.1.136.Final
netty netty 4.1.137.Final
netty netty 4.2.17.Final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-626 The product does not properly handle null bytes or NUL characters when passing data between different representations or components.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76816 is a vulnerability in Netty's MQTT codec where the MqttEncoder fails to validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding. This allows prohibited null bytes and other invalid characters in MQTT UTF-8 string fields, potentially causing routing, access-control, or identity mismatches in downstream brokers.

Detection Guidance

To detect this vulnerability, inspect Netty versions in use. Check if your system runs versions 4.2.0.Final to 4.2.16.Final or 4.1.136.Final or earlier. Use commands like 'find / -name "netty*.jar" 2>/dev/null' to locate Netty JAR files, then 'unzip -p <jar-file> META-INF/MANIFEST.MF | grep Implementation-Version' to check versions.

Impact Analysis
  • Topic hijacking: Attackers may write to unintended MQTT topics using wildcards.
  • Access-control bypass: Null bytes can bypass authentication or authorization checks.
  • Client ID collisions: Malicious clients may impersonate legitimate clients by exploiting identifier mismatches.
  • Log injection: Invalid characters in fields may corrupt logs or trigger unintended behavior.
Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Bypassing access controls may result in data breaches, triggering non-compliance with these regulations.

Mitigation Strategies

Upgrade Netty to versions 4.1.137.Final or later or 4.2.17.Final or later. Ensure MQTT encoder input validation is enforced to reject null bytes, wildcards, and control characters in client IDs, topics, usernames, and passwords.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76816. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart