Netty’s MQTT encoder fails to validate client identifiers, topic names, usernames and PUBLISH topic names. This allows the inclusion of prohibited null bytes in MQTT UTF‑8 string fields, which may cause downstream MQTT brokers to misroute packets, bypass access controls or misidentify clients. The weakness falls under input validation (CWE‑20) and improper parameter validation (CWE‑626).

The vulnerability affects the Netty framework (netty:netty). All releases before 4.1.137.Final and 4.2.17.Final are impacted; versions 4.1.137.Final, 4.2.17.Final and later contain the fix.

The CVSS score of 3.5 indicates low technical impact, and the EPSS score is not available. The vulnerability is exploitable only when an application uses Netty’s MQTT encoder to build messages from user‑controlled input. An attacker must formulate and send a crafted MQTT message containing null bytes. Because the flaw propagates downstream, the potential for serious damage depends on the configuration of the downstream broker(s). The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploitation is known at present.