{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/netty-codec-xml--4.1.135.final/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-codec-xml (4.2.0.Final - 4.2.15.Final)","netty-codec-xml (\u003c= 4.1.135.Final)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","cpu-exhaustion","network-attack","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Netty Project"],"content_html":"\u003cp\u003eA Denial of Service (DoS) vulnerability has been identified in Netty's \u003ccode\u003eXmlFrameDecoder\u003c/code\u003e component, tracked under CVE-2024-XXXX (although not explicitly assigned in source, it represents a similar class of vulnerability). This flaw allows an unauthenticated remote attacker to exhaust the CPU resources of a Netty server by sending a specially crafted malicious XML payload. Specifically, when the decoder encounters a \u003ccode\u003e\u0026lt;\u003c/code\u003e followed by a \u003ccode\u003e/\u003c/code\u003e character, it attempts to scan the remaining buffer for a closing \u003ccode\u003e\u0026gt;\u003c/code\u003e. Due to the parser's state not being preserved across \u003ccode\u003edecode()\u003c/code\u003e invocations, an attacker can deliver a payload with numerous \u003ccode\u003e\u0026lt;/\u003c/code\u003e character sequences in a trickle-feed manner. This forces the decoder to repeatedly rescan the entire accumulated buffer, causing an endless loop and consuming significant CPU on the server's EventLoop thread, ultimately rendering the server unresponsive. This impacts applications using \u003ccode\u003enetty-codec-xml\u003c/code\u003e versions within specific ranges.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker initiates an HTTP POST request targeting a Netty server configured to process XML input via \u003ccode\u003eXmlFrameDecoder\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious XML payload for the request body, specifically designed to include a large number of \u003ccode\u003e\u0026lt;/\u003c/code\u003e character sequences.\u003c/li\u003e\n\u003cli\u003eThe attacker sends this specially crafted XML payload, potentially in a trickle-feed manner, to the vulnerable Netty server.\u003c/li\u003e\n\u003cli\u003eThe Netty server's \u003ccode\u003eXmlFrameDecoder\u003c/code\u003e begins processing the incoming XML stream.\u003c/li\u003e\n\u003cli\u003eUpon encountering the \u003ccode\u003e\u0026lt;/\u003c/code\u003e sequence within the XML data, the decoder attempts to locate the corresponding closing \u003ccode\u003e\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to the decoder's implementation, which does not save its parsing state between \u003ccode\u003edecode()\u003c/code\u003e calls, it repeatedly rescans the entire accumulated buffer for a closing \u003ccode\u003e\u0026gt;\u003c/code\u003e each time a \u003ccode\u003e\u0026lt;/\u003c/code\u003e sequence is processed.\u003c/li\u003e\n\u003cli\u003eThis continuous and inefficient rescanning process consumes an excessive amount of CPU resources on the server's EventLoop thread.\u003c/li\u003e\n\u003cli\u003eThe EventLoop thread becomes unresponsive due to CPU exhaustion, leading to a complete Denial of Service for the Netty server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in a Denial of Service via CPU exhaustion. Any application utilizing Netty's \u003ccode\u003eXmlFrameDecoder\u003c/code\u003e is susceptible to this attack. An unauthenticated remote attacker can trigger the flaw by sending a relatively modest amount of malformed XML data to an exposed port, causing the server to hang completely. This can lead to significant service disruption, unavailability of critical applications, and potential financial losses for affected organizations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch \u003ccode\u003enetty-codec-xml\u003c/code\u003e\u003c/strong\u003e: Immediately update \u003ccode\u003emaven/io.netty:netty-codec-xml\u003c/code\u003e to versions beyond \u003ccode\u003e4.2.15.Final\u003c/code\u003e (for the 4.2.x line) or \u003ccode\u003e4.1.135.Final\u003c/code\u003e (for the 4.1.x line) as specified in the affected products.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMonitor CPU utilization\u003c/strong\u003e: Implement monitoring for high CPU utilization on servers processing XML input with Netty, as sustained high usage could indicate an ongoing DoS attack.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement input validation\u003c/strong\u003e: Review and enhance input validation mechanisms for all XML processing endpoints to filter or reject malformed XML payloads before they reach the \u003ccode\u003eXmlFrameDecoder\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T16:59:02Z","date_published":"2026-07-24T16:59:02Z","id":"https://feed.craftedsignal.io/briefs/2026-07-netty-xmlframedecoder-dos/","summary":"An unauthenticated remote attacker can cause a Denial of Service (DoS) in Netty servers utilizing XmlFrameDecoder by sending a specially crafted XML payload containing repeated '\u003c/' characters, leading to CPU exhaustion of the server's EventLoop thread and unresponsiveness.","title":"Netty XmlFrameDecoder CPU Exhaustion Denial of Service","url":"https://feed.craftedsignal.io/briefs/2026-07-netty-xmlframedecoder-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Netty-Codec-Xml (\u003c= 4.1.135.Final)","version":"https://jsonfeed.org/version/1.1"}