In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline… (CVE-2026-56817)

The vulnerability CVE-2026-56817 in io.netty:netty-codec-xml arises from an unconfigured XML parser that allows processing of XML input containing DOCTYPE declarations without applying security restrictions. This can lead to XML External Entity (XXE) injection risks, which depend on the behavior of the underlying Aalto XML asynchronous parser. The affected versions include 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final, as well as multiple specific package versions for Ubuntu. The CVSS v3.1 score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, so patch status is unknown.

Successful exploitation could allow an attacker to perform XML External Entity (XXE) injection attacks, potentially leading to disclosure of sensitive information, denial of service, or other impacts on confidentiality, integrity, and availability. The vulnerability is critical in severity based on the CVSS score of 9.8. However, exploitability depends on the behavior of the underlying XML parser, and no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or properly configuring XML parsing features to restrict DOCTYPE declarations and external entity processing if possible. Monitor vendor communications for updates on official fixes.