Fluid Attacks Database

Description

Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling Any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a confirmed misconfiguration with conditional exploitability.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	io.netty:netty-codec-xml	>=4.2.0.final <4.2.16.final \|\| >=4.1.0.final <4.1.136.final	4.2.16.final, 4.1.136.final
debian 11	netty	=1:4.1.48-10 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16 \|\| =1:4.1.48-4 \|\| =1:4.1.48-4+deb11u1 \|\| =1:4.1.48-4+deb11u2 \|\| =1:4.1.48-4+deb11u3 \|\| =1:4.1.48-5 \|\| =1:4.1.48-6 \|\| =1:4.1.48-7 \|\| =1:4.1.48-8 \|\| =1:4.1.48-9	-
debian 12	netty	=1:4.1.48-10 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16 \|\| =1:4.1.48-7 \|\| =1:4.1.48-7+deb12u1 \|\| =1:4.1.48-7+deb12u2 \|\| =1:4.1.48-8 \|\| =1:4.1.48-9	-
debian 13	netty	=1:4.1.48-10 \|\| =1:4.1.48-10+deb13u1 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16	-
debian 14	netty	=1:4.1.48-10 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16	-

Aliases

1. CVE-2026-568172. NVD-2026-568173. OSV-2026-568174. OSV-DEBIAN-2026-568175. GHSA-4qhr-g3c6-fcfx6. GCVE-2026-568177. SECURITY-TRACKER-CVE-2026-56817

References

1. https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx2. https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b3. https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c64. https://github.com/netty/netty/releases/tag/netty-4.1.136.Final5. https://github.com/netty/netty/releases/tag/netty-4.2.16.Final

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.