CVE-2026-56817 netty CVE debrief

Who should care

Users of Netty, especially those using versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability in Netty arises from the XmlDecoder in the channel pipeline, which can be exploited by delivering bytes to the pipeline. This allows an attacker to send XML with a DOCTYPE declaration to an AsyncXMLInputFactory with no security configuration. Depending on the Aalto XML async parser behavior, this could lead to conditional XML external entity risk. The issue affects Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. It was fixed in versions 4.1.136.Final and 4.2.16.Final. Users should review their channel pipelines for XmlDecoder and ensure proper security configurations are in place to mitigate this vulnerability.

Defensive priority

High priority should be given to updating Netty to versions 4.1.136.Final or 4.2.16.Final, or later. Additionally, users should review their channel pipelines for XmlDecoder and ensure proper security configurations are in place.

Recommended defensive actions

• Update Netty to version 4.1.136.Final or 4.2.16.Final, or later.
• Review channel pipelines for XmlDecoder and ensure proper security configurations.
• Monitor for and restrict suspicious XML traffic.
• Implement compensating controls such as Web Application Firewalls.
• Conduct regular inventory checks for affected Netty versions.

Evidence notes

The CVE record was published on 2026-07-21T23:17:52.127Z and was last modified on 2026-07-22T20:35:40.827Z. The NVD entry is currently Awaiting Analysis. The vulnerability has a CVSS score of 8.3 and is classified as HIGH severity.

Official resources