GHSA-JFG9-48MV-9QGX Netty MQTT: Resource exhaustion in MqttDecoder

Impact The MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader method is called before the bytesRemainingBeforeVariableHeader maxBytesInMessage check. The decodeVariableHeader can call other metho...

PT-2026-38399

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description Resource exhaustion occurs because the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. In the MqttDecoder class, the decodeVariableHeader...

wolfmqtt: Heap-buffer-overflow in MqttDecode_Num

Detailed Report: https://oss-fuzz.com/testcase?key=5146254703722496 Project: wolfmqtt Fuzzing Engine: afl Fuzz Target: wolfmqtt-fuzzer Job Type: aflasanwolfmqtt Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x621000008f07 Crash State: MqttDecodeNum MqttDecodeString...

wolfmqtt:wolfmqtt-fuzzer: Crash in MqttDecode_Props

Project: https://github.com/wolfSSL/wolfMQTT.git Detailed Report: https://oss-fuzz.com/testcase?key=5112634807025664 Project: wolfmqtt Fuzzing Engine: libFuzzer Fuzz Target: wolfmqtt-fuzzer Job Type: libfuzzermsanwolfmqtt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x720000011008...

wolfmqtt:wolfmqtt-fuzzer: Crash in MqttDecode_Num

Project: https://github.com/wolfSSL/wolfMQTT.git Detailed Report: https://oss-fuzz.com/testcase?key=4540422754009088 Project: wolfmqtt Fuzzing Engine: libFuzzer Fuzz Target: wolfmqtt-fuzzer Job Type: libfuzzerasanwolfmqtt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x621000013a16...