CVE-2026-56817 affects the io.netty:netty-codec-xml component where the XmlDecoder uses an XML parser instantiated without security configurations to disable DTD and external entity processing. Attackers able to send XML data to a Netty channel pipeline containing XmlDecoder can include a DOCTYPE declaration, potentially triggering XML External Entity injection. However, whether external entities are resolved depends on the asynchronous parsing behavior of the Aalto XML parser used internally, making this a confirmed misconfiguration with conditional exploitability. The vulnerability is categorized under CWE-611 (Improper Restriction of XML External Entity Reference).

If exploited, this vulnerability could allow an attacker to perform XML External Entity (XXE) injection attacks, potentially leading to information disclosure or other impacts depending on the XML parser's behavior. The actual impact depends on whether the external entities are resolved by the underlying parser, which is conditional and not guaranteed. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should ensure that XML parsers used in the Netty XML codec are securely configured to disable DTD processing and external entity resolution. Review and harden XML parser configurations to prevent processing of untrusted XML input with active DTDs or external entities.