RHLW-2026-48B9709BA25473BE Lightwell Security Advisory: netty-codec-mqtt 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-mqtt 4.1.100.Final-rhlw-00001 with a backported security fix. CVE-2026-44248: Netty: Resource exhaustion in MqttDecoder This patched artifact is a drop-in replacement for io.netty:netty-codec-mqtt 4.1.100.Final from Maven Central...

CVE-2026-93575 Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits...

ai.spice:spiceai (0.6.0), ch.nolix:nolix (0.0.0) +960 more potentially affected by CVE-2026-93575 via io.netty:netty-codec-mqtt (>=4.2.0.final, <=4.2.17.final)

io.netty:netty-codec-mqtt MAVEN version =4.2.0.final, =4.2.17.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-mqtt and may be impacted: - ai.spice:spiceai 0.6.0 - ch.nolix:nolix 0.0.0 - ch.zzeekk.spark:spark-temporalquery2.13...

CVE-2026-93575 Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization through the CONNECT and PUBLISH encoding paths in MqttEncoder and MqttCodecUtil. An attacker can send MQTT fields containing NUL bytes or wildcard characters by supplying crafted client identifiers, usernames, wi...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4876 more potentially affected by CVE-2026-44248 via io.netty:netty-codec-mqtt (>=4.1.5.final, <=4.1.132.final)

io.netty:netty-codec-mqtt MAVEN version =4.1.5.final, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.2, =0.0.2, =0.0.2, =0.3.0 and more Source cves:...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +820 more potentially affected by CVE-2026-44248 via io.netty:netty-codec-mqtt (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-mqtt MAVEN version =4.2.0.alpha1, =4.2.12.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-mqtt and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +820 more potentially affected by CVE-2026-44248 via io.netty:netty-codec-mqtt (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-mqtt MAVEN version =4.2.0.alpha1, =4.2.12.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-mqtt and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of size limits applied to the Properties section during the decoding process. An attacker can cause excessive CPU and memory consumption by sending MQTT messages with...