https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 03:25:17 +0000 https://db.gcve.eu/vuln/ghsa-jfg9-48mv-9qgx <p><strong>Affected:</strong> Maven: io.netty:netty-codec-mqtt</p> <p>### Impact The MQTT 5 header Properties section is parsed and buffered _before_ any message size limit is applied.</p> <p>Specifically, in `MqttDecoder`, the `decodeVariableHeader()` method is called before the `bytesRemainingBeforeVariableHeader &gt; maxBytesInMessage` check. The `decodeVariableHeader()` can call other methods which will call `decodeProperties()`. Effectively, Netty does not apply any limits to the size of the properties being decoded.</p> <p>Additionally, because `MqttDecoder` extends `ReplayingDecoder`, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion.</p> <p>This can cause high resource usage in both CPU and memory.</p> <p>### Resources `ANT-2026-09608` https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html#_Toc3901027</p> <p><strong>Affected:</strong> Maven: io.netty:netty-codec-mqtt</p> <p>### Impact The MQTT 5 header Properties section is parsed and buffered _before_ any message size limit is applied.</p> <p>Specifically, in `MqttDecoder`, the `decodeVariableHeader()` method is called before the `bytesRemainingBeforeVariableHeader &gt; maxBytesInMessage` check. The `decodeVariableHeader()` can call other methods which will call `decodeProperties()`. Effectively, Netty does not apply any limits to the size of the properties being decoded.</p> <p>Additionally, because `MqttDecoder` extends `ReplayingDecoder`, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion.</p> <p>This can cause high resource usage in both CPU and memory.</p> <p>### Resources `ANT-2026-09608` https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html#_Toc3901027</p> https://db.gcve.eu/vuln/ghsa-jfg9-48mv-9qgx