CVE-2026-44248

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>netty</name>
	<range><lt>4.1.133</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Netty is an asynchronous, event-driven network application framework.
	Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties
	section is parsed and buffered before any message size limit is
	applied. Specifically, in MqttDecoder, the decodeVariableHeader()
	method is called before the bytesRemainingBeforeVariableHeader >
	maxBytesInMessage check. The decodeVariableHeader() can call other
	methods which will call decodeProperties(). Effectively, Netty does
	not apply any limits to the size of the properties being decoded.
	Additionally, because MqttDecoder extends ReplayingDecoder, Netty will
	repeatedly re-parse the enormous Properties sections and buffer the
	bytes in memory, until the entire thing parses to completion. This can
	cause high resource usage in both CPU and memory. This vulnerability
	is fixed in 4.2.13.Final and 4.1.133.Final.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-44248</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-44248</url>
    </references>
    <dates>
      <discovery>2026-05-13</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>