GHSA-4qhr-g3c6-fcfxHigh
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
🔗 CVE IDs covered (1)
📋 Description
Any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a confirmed misconfiguration with conditional exploitability.
🎯 Affected products2
- maven/io.netty:netty-codec-xml:>= 4.2.0.Final, <= 4.2.15.Final
- maven/io.netty:netty-codec-xml:>= 4.1.0.Final, <= 4.1.135.Final
🔗 References (7)
- https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx
- https://nvd.nist.gov/vuln/detail/CVE-2026-56817
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
- https://github.com/advisories/GHSA-4qhr-g3c6-fcfx