PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56817 netty CVE debrief

CVE-2026-56817 is a high-severity vulnerability in Netty, a network application framework. The issue allows for conditional XML external entity risk due to DTD and entity handling being active in certain configurations. This vulnerability affects Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. It was fixed in versions 4.1.136.Final and 4.2.16.Final.

Vendor
netty
Product
Unknown
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Users of Netty, especially those using versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability in Netty arises from the XmlDecoder in the channel pipeline, which can be exploited by delivering bytes to the pipeline. This allows an attacker to send XML with a DOCTYPE declaration to an AsyncXMLInputFactory with no security configuration. Depending on the Aalto XML async parser behavior, this could lead to conditional XML external entity risk. The issue affects Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. It was fixed in versions 4.1.136.Final and 4.2.16.Final. Users should review their channel pipelines for XmlDecoder and ensure proper security configurations are in place to mitigate this vulnerability.

Defensive priority

High priority should be given to updating Netty to versions 4.1.136.Final or 4.2.16.Final, or later. Additionally, users should review their channel pipelines for XmlDecoder and ensure proper security configurations are in place.

Recommended defensive actions

  • Update Netty to version 4.1.136.Final or 4.2.16.Final, or later.
  • Review channel pipelines for XmlDecoder and ensure proper security configurations.
  • Monitor for and restrict suspicious XML traffic.
  • Implement compensating controls such as Web Application Firewalls.
  • Conduct regular inventory checks for affected Netty versions.

Evidence notes

The CVE record was published on 2026-07-21T23:17:52.127Z and was last modified on 2026-07-22T20:35:40.827Z. The NVD entry is currently Awaiting Analysis. The vulnerability has a CVSS score of 8.3 and is classified as HIGH severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56817 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56817

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56817 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56817

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.