Skip to main content

Netty CVE-2026-56817

HIGH
Improper Restriction of XML External Entity Reference (CWE-611)
2026-07-21 security-advisories@github.com GHSA-4qhr-g3c6-fcfx
XXE Netty Red Hat
8.3
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but AC:H because it needs the non-default XmlDecoder plus conditional Aalto entity resolution; impact is mainly file disclosure (C:H) with minor availability (A:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 22, 2026 - 00:33 vuln.today
Analysis Generated
Jul 22, 2026 - 00:33 vuln.today
CVE Published
Jul 21, 2026 - 23:17 cve.org
HIGH 8.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 73 maven packages depend on io.netty:netty-codec-xml (1 direct, 72 indirect)

Ecosystem-wide dependent count for version 4.2.0.Final.

DescriptionCVE.org

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to an AsyncXMLInputFactory instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

AnalysisAI

XML external entity exposure in the Netty network framework affects the optional XmlDecoder handler in versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, where the underlying Aalto AsyncXMLInputFactory is instantiated without any security hardening. Any remote party able to push bytes into a channel pipeline that contains XmlDecoder can submit XML carrying a DOCTYPE/DTD declaration, and depending on Aalto async parser behavior DTD and entity processing remains active, creating a conditional path to reading local files or performing SSRF-style out-of-band requests. There is no public exploit identified at time of analysis, the issue is not on CISA KEV, and it is fixed in 4.1.136.Final and 4.2.16.Final.

Technical ContextAI

Netty is a widely used asynchronous event-driven Java network framework; the affected component is the io.netty.handler.codec.xml.XmlDecoder, a ChannelHandler that streams XML using the Aalto non-blocking XML parser exposed through com.fasterxml.aalto.AsyncXMLInputFactory. The root cause is CWE-611 (Improper Restriction of XML External Entity Reference): the factory is created with default settings and no calls to disable DTDs (SUPPORT_DTD), external general/parameter entities, or to enable secure processing, so a DOCTYPE declaration in attacker-supplied XML can drive the parser to resolve external entities. Because Aalto is an asynchronous parser, whether and how the external entity is actually dereferenced is dependent on Aalto's async parsing behavior, which is why the advisory describes the XXE as conditional rather than guaranteed. The fix hardens the factory configuration inside XmlDecoder so DTD/entity handling is disabled by default.

RemediationAI

Vendor-released patch: upgrade to Netty 4.1.136.Final (for the 4.1.x line, https://github.com/netty/netty/releases/tag/netty-4.1.136.Final) or 4.2.16.Final (for the 4.2.x line, https://github.com/netty/netty/releases/tag/netty-4.2.16.Final), which configure the Aalto factory to disable DTD and external entity processing. If you cannot upgrade immediately, the concrete compensating control is to avoid feeding untrusted XML to XmlDecoder: remove XmlDecoder from pipelines that handle attacker-reachable input, or restrict those endpoints to trusted/authenticated sources so untrusted XML cannot reach the parser (trade-off: this may break legitimate XML-consuming clients). Where you construct the parser yourself, explicitly harden the AsyncXMLInputFactory by disabling SUPPORT_DTD and external entity resolution and enabling secure processing before it is used. Consult advisory GHSA-4qhr-g3c6-fcfx for details; the fix commits are 5b68c61f37aa4a3045cba624cbea239655c9003b and bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
CVE-2026-50011 HIGH POC
7.5 Jun 12

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
CVE-2022-41881 HIGH POC
7.5 Dec 12

Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner
CVE-2020-7238 HIGH POC
7.5 Jan 27

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Tr
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all
CVE-2019-9670 CRITICAL POC
9.8
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2012-3363 CRITICAL POC
9.1
CVE-2016-4264 HIGH POC
8.6

Same technique XXE

View all
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2013-5014 HIGH POC
7.5
CVE-2015-0923 MEDIUM POC
5.0
CVE-2014-0644 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

Share

CVE-2026-56817 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy