Executive brief
A vulnerability in the Netty networking framework allows an attacker to crash or freeze a server by sending a small amount of malicious XML data. Netty is a widely used library for building high-performance network applications; an exploit could lead to a total service outage for any application using its XML processing features. This issue can be triggered remotely without any login credentials.
Technical details
The io.netty.handler.codec.xml.XmlFrameDecoder component fails to properly manage parser state between decode() invocations. When the decoder encounters a specific sequence (e.g., '</'), it scans the remaining buffer for a closing character. By trickle-feeding these characters, an attacker forces the decoder to repeatedly rescan the entire accumulated buffer, leading to O(n^2) complexity. This uncontrolled resource consumption (CWE-400) can hang the Netty EventLoop thread indefinitely. The issue is resolved in versions 4.1.136.Final and 4.2.16.Final.
Affected products
- Netty netty-codec-xml >= 4.2.0.Final, <= 4.2.15.Final; <= 4.1.135.Final
Timeline
- 2026-07-23: disclosed
- 2026-07-24: advisory: GitHub Advisory GHSA-v74w-7mr3-4qg3 published
- 2026-07-24: patched