Netty CVE-2026-56817

Exploitation requires that the target application include io.netty.handler.codec.xml.XmlDecoder in a Netty channel pipeline and route attacker-deliverable bytes to it - this is an opt-in, non-default component, so a stock Netty user without the XML codec is not exposed. The attacker must be able to deliver XML containing a DOCTYPE/DTD declaration to that pipeline; no authentication or user interaction is indicated by the vector (PR:N/UI:N). The principal limiting factor, encoded as AT:P (attack requirement present) in the CVSS 4.0 vector, is that DTD and external-entity dereferencing is conditional on Aalto async parser behavior, so exploitation is not guaranteed on every request. Affected versions are limited to 4.2.0.Final-4.2.15.Final and 4.1.0.Final-4.1.135.Final.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L, score 8.3) describes a network-reachable, unauthenticated, no-user-interaction issue whose main impact is confidentiality (VC:H, consistent with file/data disclosure via XXE) plus a minor availability effect (VA:L), and importantly carries AT:P - an attack requirement - reflecting the conditional 'depending on Aalto async parser behavior' language. That AT:P is the key nuance: raw severity looks high, but real exploitability hinges on both a non-default deployment (the application must place XmlDecoder in its pipeline and feed it attacker-controlled XML) and on parser behavior that may or may not dereference external entities. No EPSS score, SSVC decision, or KEV entry was provided in the input, and no public POC is referenced, so exploitation probability cannot be quantified from the data given. Net assessment: a genuinely serious class of bug where XmlDecoder is used, but the conditional trigger and the fact that most Netty deployments do not use the XML codec mean this is more of a patch-in-normal-cycle priority than an emergency for the majority of Netty users - those actually parsing untrusted XML through Netty should treat it as high priority.

An application uses Netty's XmlDecoder to parse XML received over the network from untrusted clients. An attacker sends an XML document containing a DOCTYPE with an external entity pointing at a local file or an internal URL; if Aalto's async parser resolves the entity, the file contents or the result of the internal request are reflected back or exfiltrated out-of-band. No public POC is referenced in the provided data, and success depends on the conditional parser behavior captured by the AT:P metric.