THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-44248 (MEDIUM 5.3) — Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is

[NVD] CVE-2026-44248 (MEDIUM 5.3) — Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is

lownvdPublished 2026-05-13

CVE-2026-44248 CVSS: 5.3 MEDIUM Published: 2026-05-13T19:17:27.143

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader

Indicators of compromise

CVE-2026-44248cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-44248