Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.netty:netty-codec-xml

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5MavenPublished

    Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

    CVE-2026-73507 · GHSA-v74w-7mr3-4qg3

    Affected
    • Maven io.netty:netty-codec-xml >= 4.2.0.Final, <= 4.2.15.Final; <= 4.1.135.Final
    Fixed in
    4.2.16.Final4.1.136.Final· Vendor fix available
    Issue
    An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated </ characters) to a Netty server utilizing XmlFrameDecoder, causing the server's EventLoop thread to exhaust CPU resources and become unresponsive. Details io.netty.handler.codec.xml.XmlFrameDecoder suffers from a vulnerability resulting in CPU exhaustion. When < followed by / is encountered, the decoder scans the remaining buffer for a closing . Because the parser state is not saved between decode() invocations, an attacker can trickle-feed a payload of </ characters. This forces the decoder to repeatedly rescan the entire accumulated buffer. A 1MB maxFrameLength is enough to completely hang a server's thread while it loops endlessly. Impact Denial of Service via CPU Exhaustion. Any application utilizing Netty's XmlFrameDecoder is impacted. An unauthenticated remote attacker can exploit this flaw by sending a modest amount of malformed XML data to an exposed port.

    Recommended action: Upgrade to 4.2.16.Final or 4.1.136.Final by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 8.3MavenPublished

    Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling

    CVE-2026-56817 · GHSA-4qhr-g3c6-fcfx

    Affected
    • Maven io.netty:netty-codec-xml >= 4.2.0.Final, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final
    Fixed in
    4.2.16.Final4.1.136.Final· Vendor fix available
    Issue
    Any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a confirmed misconfiguration with conditional exploitability.

    Recommended action: Upgrade to 4.2.16.Final or 4.1.136.Final by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →