Skip to content
Threat Feed
Subscribe

Product

Netty-Codec-Xml (4.1.0.Final - 4.1.135.Final)

1 brief RSS
high advisory

Netty XML Injection Vulnerability (CVE-2026-56817)

A misconfiguration vulnerability (CVE-2026-56817) in Netty's XmlDecoder component allows attackers to send XML with DOCTYPE declarations to an unconfigured XML factory, potentially leading to XML External Entity (XXE) injection if the underlying Aalto XML parser resolves external entities, impacting Netty applications using `netty-codec-xml` versions 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final.

netty-codec-xml +1 netty xml xxe vulnerability java server-side web-application
1r 1t 1c