Skip to content
OpenAdvisories

Package · Maven

io.netty:netty-codec-xml

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2026-73507

    Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

    Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote att…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 8.3
    CVE-2026-56817

    Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder`…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven