Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2308-1 advisory.

    This update for netty, netty-tcnative fixes the following issues

    - CVE-2026-41417: missing validations leads to HTTP request smuggling and RTSP request injection via     start-line       injection in `DefaultHttpRequest.setUri()` (bsc#1264350).
    - CVE-2026-42578: HTTP Header Injection via HttpProxyHandler Disabled Validation in Netty (bsc#1265243).
    - CVE-2026-42579: DNS codec does not enforce RFC 1035 domain name constraints during either encoding or     decoding       (bsc#1265272).
    - CVE-2026-42580: chunk size parser silently overflows int and enables request smuggling attacks     (bsc#1265273).
    - CVE-2026-42581: TE+CL header coexistence in HTTP/1.0 requests bypasses smuggling sanitization     (bsc#1265277).
    - CVE-2026-42583: resource exhaustion and possible denial of service via `Lz4FrameDecoder` (bsc#1265279).
    - CVE-2026-42584: improper handling of inbound responses in `HttpClientCodec` can lead to response     desynchronization       (bsc#1265280).
    - CVE-2026-42585: Netty is an asynchronous, event-driven network application framework (bsc#1265292).
    - CVE-2026-42586: CRLF Injection in Netty Redis Codec Encoder (bsc#1265245).
    - CVE-2026-42587: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy     enables       decompression bomb DoS (bsc#1265246).
    - CVE-2026-44248: Netty is an asynchronous, event-driven network application framework (bsc#1265294).
    - CVE-2026-42582: HTTP/3 QPACK literal unbounded allocation (bsc#1265318).

    Changes for netty:

    - Upgrade to upstream version 4.1.133

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and     4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit     is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the     bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other     methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of     the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will     repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire     thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability     is fixed in 4.2.13.Final and 4.1.133.Final. (CVE-2026-44248)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and
    4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit
    is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the
    bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other
    methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of
    the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will
    repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire
    thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability
    is fixed in 4.2.13.Final and 4.1.133.Final. (CVE-2026-44248)

ID	Name	Product	Family	Type	Severity
321020	SUSE SLED15 / SLES15 Security Update : netty, netty-tcnative (SUSE-SU-2026:2308-1)	Nessus	SuSE Local Security Checks	Local	medium
314742	Linux Distros Unpatched Vulnerability : CVE-2026-44248	Nessus	Misc.	Local	high
441434	SCA: security update for io.netty:netty-codec-mqtt (GHSA-jfg9-48mv-9qgx)	Tenable Cloud Security	SCA Checks	Local	high
441434	SCA: security update for io.netty:netty-codec-mqtt (GHSA-jfg9-48mv-9qgx)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-44248

high

Tenable Plugins

medium

high

high

high