{"id":"GHSA-v74w-7mr3-4qg3","title":"Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion","summary":"Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion","severity":"high","cvss":7.5,"cwe":["CWE-400"],"vendor":"netty","product":"io.netty:netty-codec-xml","ecosystem":"maven","affected":["io.netty:netty-codec-xml >= 4.2.0.Final, <= 4.2.15.Final","io.netty:netty-codec-xml <= 4.1.135.Final"],"patched":["io.netty:netty-codec-xml 4.2.16.Final","io.netty:netty-codec-xml 4.1.136.Final"],"published":"2026-07-24","updated":"2026-07-24","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-v74w-7mr3-4qg3","references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-v74w-7mr3-4qg3"},{"url":"https://github.com/netty/netty/pull/17063"},{"url":"https://github.com/netty/netty/pull/17065"},{"url":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"url":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"},{"url":"https://github.com/advisories/GHSA-v74w-7mr3-4qg3"}],"tags":["ghsa","maven"],"ingestedAt":"2026-07-24T17:34:27.482Z","slug":"GHSA-v74w-7mr3-4qg3","body":"## Overview\n\n### Summary\nAn attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated `</` characters) to a Netty server utilizing XmlFrameDecoder, causing the server's EventLoop thread to exhaust CPU resources and become unresponsive.\n\n### Details\n`io.netty.handler.codec.xml.XmlFrameDecoder` suffers from a vulnerability resulting in CPU exhaustion. When `<` followed by `/` is encountered, the decoder scans the remaining buffer for a closing `>`.\nBecause the parser state is not saved between `decode()` invocations, an attacker can trickle-feed a payload of `</` characters. This forces the decoder to repeatedly rescan the entire accumulated buffer. A 1MB `maxFrameLength` is enough to completely hang a server's thread while it loops endlessly.\n\n### Impact\nDenial of Service via CPU Exhaustion. Any application utilizing Netty's XmlFrameDecoder is impacted. An unauthenticated remote attacker can exploit this flaw by sending a modest amount of malformed XML data to an exposed port.\n\n## Affected packages\n\n- `io.netty:netty-codec-xml >= 4.2.0.Final, <= 4.2.15.Final`\n- `io.netty:netty-codec-xml <= 4.1.135.Final`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `io.netty:netty-codec-xml 4.2.16.Final`\n- `io.netty:netty-codec-xml 4.1.136.Final`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}