CVE-2026-93575

Executive Summary

CVE-2026-93575 is an incomplete-fix vulnerability in Netty's MQTT codec (io.netty.handler.codec.mqtt.MqttDecoder), where the mitigation originally deployed for CVE-2026-44248 fails to validate a packet's Properties Length against its declared Remaining Length. Any application that exposes Netty's MQTT decoder to untrusted network input — particularly public-facing MQTT brokers, IoT gateways, and message-bus front-ends — is affected. An unauthenticated remote attacker can send a crafted CONNECT packet with a small Remaining Length but an enormous Properties Length, forcing Netty to buffer and parse millions of UserProperty objects until an OutOfMemoryError terminates the service.

Technical Analysis

The defect resides in Netty's MQTT decoder, specifically in the decodeProperties() helper method invoked during packet parsing within io.netty.handler.codec.mqtt.MqttDecoder. The method reads a field identified as totalPropertiesLength and attempts to parse that many bytes from the incoming buffer. If the available buffer does not yet contain the full length, the decoder raises a Signal to indicate that more data is required — this is a normal control-flow mechanism used by ReplayingDecoder to suspend decoding until additional bytes arrive from the network.

The security flaw lies in the scope of the size enforcement performed by the original fix for CVE-2026-44248. When the Signal is thrown and control reaches the catch block inside decode(), the code enforces the configured maxBytesInMessage limit only against bytesRemainingBeforeVariableHeader — that is, the value encoded in the MQTT packet's Remaining Length field. There is no corresponding check that the Properties Length value is itself bounded by, or consistent with, the Remaining Length.

Because the MQTT v5 property framework permits a variable-length integer to declare an arbitrarily large Properties Length independently of the packet's overall Remaining Length, an attacker can construct a packet where:

• Remaining Length is small (well under maxBytesInMessage), so the size check passes.
• Properties Length is enormous, so the decoder's ReplayingDecoder state machine continues to request and buffer additional network data until that declared length is satisfied.

Each buffered segment is parsed into individual UserProperty objects within the properties collection. Because the parser keeps consuming until totalPropertiesLength bytes have been read, the process accumulates millions of property entries, driving both heap consumption (object allocations plus backing buffer growth) and CPU consumption (parsing and object construction per property). The terminal effect is an OutOfMemoryError that takes down the affected process.

The vulnerability class is a denial-of-service condition arising from inconsistent bounds enforcement across two related length fields — a canonical incomplete-fix pattern (CWE-1035, "Incomplete Identification of Validated Inputs"). The absence of any authentication requirement in the described attack path (the packet is a CONNECT, which precedes authenticated session establishment) makes the exposure fully unauthenticated. No public proof-of-concept, exploit code, or Nuclei template has been observed, and FIRST.org has not yet assigned an EPSS score.

Exploitation Scenarios

Attack chain inference is constrained by the available description; no public PoC exists, and the steps below stay at the vulnerability-class level.

1. Reconnaissance / target identification. An adversary identifies a reachable endpoint that terminates MQTT traffic with Netty's codec — typically an MQTT broker or an IoT/message-bus front-end listening on the standard MQTT port (1883 plaintext or 8883 TLS). Fingerprinting may rely on banner behavior, error responses from malformed packet handling, or service identification via scanning. Because the vulnerable parser processes the initial CONNECT, the adversary does not need valid credentials.

2. Triggering the flaw class. The attacker initiates a TCP session and transmits an MQTT CONNECT packet whose Remaining Length is deliberately small — large enough to be structurally plausible and below the configured maxBytesInMessage, but far smaller than the Properties Length value embedded inside it. This asymmetry is the precise condition the incomplete fix for CVE-2026-44248 fails to detect: the size check validates only bytesRemainingBeforeVariableHeader.

3. Payload/execution at the vulnerability-class level. Following the CONNECT, the attacker keeps the socket open and streams additional data. Because the declared Properties Length exceeds the data actually received, decodeProperties() throws a Signal, and ReplayingDecoder suspends parsing and buffers incoming bytes until totalPropertiesLength is reached. The attacker supplies data incrementally (or in bulk) to satisfy that declared length, causing the decoder to construct an extremely large number of UserProperty objects.

4. Post-exploitation impact. Sustained buffering and per-property parsing exhaust heap and CPU, culminating in OutOfMemoryError and process termination. Depending on deployment, this produces a service outage, cascading failures for downstream MQTT clients, and potential loss of in-flight messages. Repeated attack cycles can maintain an outage for as long as the adversary chooses to continue transmitting malformed CONNECT packets — a low-effort, unauthenticated denial of service.

No public exploit, weaponized tooling, or threat-actor attribution is currently associated with this CVE; the chain above is inferred strictly from the NVD description and the vulnerability class.

Impact Assessment

The impact is availability-only. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects: network-exploitable, low attack complexity, no privileges required, no user interaction, scope unchanged, and a high availability impact. Confidentiality and integrity are unaffected — the attacker cannot read or modify message content through this vector alone.

Blast radius depends on architecture. A standalone broker crash affects all connected publishers and subscribers, potentially causing message loss for non-durable topics and disrupting dependent industrial or telemetry workflows. In a clustered deployment, member termination can trigger failover storms or, if the attacker targets nodes in parallel, cluster-wide degradation. IoT gateways bridging MQTT to internal systems may lose the ability to relay telemetry, with associated downstream data gaps.

Because exploitation requires no credentials or user action and can be repeated trivially with a single socket, the vulnerability is attractive for low-skill, high-noise denial-of-service campaigns. Even without weaponized exploits, the attack is reachable by anyone capable of speaking MQTT.

Detection Guidance

Sigma Rule

title: Netty MQTT Decoder Properties Length Mismatch DoS Attempt
id: 9f3c0f2a-7a41-4a5f-9c11-1e6f935752026
status: experimental
description: Detects a process crash (OutOfMemoryError) associated with Netty MQTT decoding of oversized Properties Length values
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93575
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: application
  product: java
detection:
  selection_oom:
    message|contains:
      - 'OutOfMemoryError'
  selection_netty:
    message|contains:
      - 'io.netty.handler.codec.mqtt'
      - 'MqttDecoder'
      - 'decodeProperties'
  condition: selection_oom and selection_netty
falsepositives:
  - Legitimate memory pressure from high-throughput brokers
  - Oversized but valid property sets
level: high
tags:
  - attack.t1499
  - cve.2026.93575

YARA Rule

rule CVE_2026_93575_MQTT_Properties_Length_DoS
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects MQTT CONNECT packets referencing oversized Properties Length used to trigger CVE-2026-93575"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93575"
        date = "2026-01-01"
        severity = "high"

    strings:
        $mqtt_connect = { 10 ?? 00 04 4D 51 54 54 }   // CONNECT protocol name "MQTT"
        $properties_marker = { 05 }                     // MQTT v5 property section indicator context

    condition:
        $mqtt_connect and uint16be(0x02) < 0x0500       // Remaining Length far smaller than typical
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET [1883,8883] (msg:"CVE-2026-93575 Netty MQTT Properties Length DoS Attempt"; flow:established,to_server; content:"|10|"; depth:1; content:"|00 04 4D 51 54 54|"; within:8; byte_test:2,<,256,2,relative; threshold:type both, track by_src, count 1, seconds 300; classtype:attempted-dos; sid:202693575; rev:1; reference:cve,2026-93575;)

Elastic Detection

process where event.action == "log" and process.name == "java"
  and message contains "io.netty.handler.codec.mqtt.MqttDecoder"
  and message contains "OutOfMemoryError"

Splunk SPL Query

index=application sourcetype=java_logs
| search "io.netty.handler.codec.mqtt" AND "OutOfMemoryError"
| stats count by host, source, message
| where count > 0

Wazuh OSSEC Rule

<group name="netty,mqtt,cve-2026-93575,">
  <rule id="935750" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">io\.netty\.handler\.codec\.mqtt\.MqttDecoder</field>
    <field name="message">OutOfMemoryError</field>
    <description>Possible exploitation of CVE-2026-93575 (Netty MQTT Properties Length denial of service)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Apply an upstream bounds check on any MQTT termination point: validate that Properties Length never exceeds Remaining Length (and is itself below maxBytesInMessage) before allowing Netty to buffer.
• Where possible, disable MQTT v5 property support or restrict inbound MQTT to authenticated, allowlisted sources.
• Front-load a reverse proxy or load balancer capable of L4/L7 inspection and connection-rate limiting for MQTT (ports 1883/8883).
• Deploy process restart policies and heap ceilings so a crashing broker fails fast and recovers under supervision, minimizing outage windows.
• Monitor for repeated CONNECT traffic with anomalous Properties Length values and rate-limit offending sources.

2) Patch/upgrade steps

• No vendor fix exists as of this report. Track Netty releases and the CVE-2026-44248 fix lineage for a revised decoder that validates Properties Length against Remaining Length.
• When a patched release becomes available, upgrade all Netty dependents (brokers, gateways, custom codecs) and rebuild affected artifacts.
• Verify the fix closes the asymmetry in decodeProperties()/decode() rather than only re-checking maxBytesInMessage.

3) Long-term hardening

• Adopt a policy of validating all length/offset fields against peer fields, not just against a globally configured maximum — this is the exact pattern that the incomplete fix missed.
• Continuously ingest CVE data for Netty and its codec dependencies; treat incomplete-fix advisories (CWE-1035) as high priority for verification.
• Add regression tests that feed offset/decoder components with length-field asymmetry cases (small outer length, huge declared inner length) to catch recurrence.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-93575
• NVD — CVE-2026-44248 (the incomplete fix this CVE addresses; consult NVD for the original advisory)
• Netty project security advisories — https://netty.io/ and https://github.com/netty/netty/security/advisories
• CWE-1035 — Incomplete Identification of Validated Inputs: https://cwe.mitre.org/data/definitions/1035.html
• CISA KEV catalog (currently does NOT list CVE-2026-93575 as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, in-the-wild exploitation evidence, public PoC, or Nuclei template are currently associated with CVE-2026-93575.