CVE-2026-76816— Netty: MQTT Topic Name and Client ID Validation Bypass
Quick assessment
Affected
netty netty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Netty 是一个异步的、基于事件驱动的网络应用框架。在 4.1.137.Final 和 4.2.17.Final 版本之前，MqttEncoder 在编码前未对客户端标识符、Will 主题、用户名以及 PUBLISH 消息中的主题名称进行有效性验证。这允许在 MQTT UTF-8 字符串字段中插入被禁止的空字节（null bytes），并可能导致下游代理（broker）中出现路由错误、访问控制失效或身份不匹配等问题。 当应用程序使用 Netty 的 MQTT 编码器，基于用户可控的输入构造消息时，该漏洞可被利用。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76816
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netty: MQTT Topic Name and Client ID Validation Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and potentially causing routing, access-control, or identity mismatches in downstream brokers. The vulnerability is exploitable when an application uses Netty's MQTT encoder to construct messages from user-controlled input. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-76816
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76816
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-76816 (1)
IV. Related Vulnerabilities
Same product: netty
-
CVE-2026-62380
Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection -
CVE-2026-62243
Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass -
CVE-2026-75595
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Cau -
CVE-2026-75596
Netty: Fragmented ClientHello records trigger quadratic pre- -
CVE-2026-59903
Netty: Cache Poisoning and Information Disclosure via CORS V
Same vendor: netty
-
CVE-2026-62380
Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection -
CVE-2026-62243
Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass -
CVE-2026-75595
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Cau -
CVE-2026-75596
Netty: Fragmented ClientHello records trigger quadratic pre- -
CVE-2026-59903
Netty: Cache Poisoning and Information Disclosure via CORS V
Same weakness: CWE-20
-
CVE-2026-65979
OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidate -
CVE-2026-71443
CAI Content Credentials | Improper Input Validation (CWE-20) -
CVE-2026-76198
CAI Content Credentials | Improper Input Validation (CWE-20) -
CVE-2026-34959
Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix -
CVE-2026-16434
Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass
V. Comments for CVE-2026-76816
No comments yet