GHSA-4qhr-g3c6-fcfx
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.netty:netty-codec-xml | >= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
| Maven | io.netty:netty-codec-xml | >= 4.1.0.Final, < 4.1.136.Final | 4.1.136.Final |
Details
As written in the advisory (Markdown source, shown as plain text).
Any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a confirmed misconfiguration with conditional exploitability.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx
- https://nvd.nist.gov/vuln/detail/CVE-2026-56817
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/netty/netty
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final