Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-56817: Netty can be tricked into reading external files
CVE-2026-56817 · published 3 months ago
Summary
If your application uses Netty’s XML decoder, an attacker who can send data to it could embed special XML that makes the system read files from the server or network. This could expose sensitive information or cause other unwanted behavior. Upgrade Netty to version 4.1.136.Final or later, or 4.2.16.Final or later, to stop the issue.
What to do
- Update netty io.netty:netty-codec-xml to version 4.2.16.Final.
- Update netty io.netty:netty-codec-xml to version 4.1.136.Final.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:22.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | netty | All versions |
| – | netty | netty |
>= 4.2.0.Final, < 4.2.16.Final >= 4.1.0, < 4.1.136 >= 4.2.0, < 4.2.16 |
| maven | netty | io.netty:netty-codec-xml |
>= 4.2.0.Final, <= 4.2.15.Final >= 4.1.0.Final, <= 4.1.135.Final Fix: upgrade to 4.2.16.Final
|
| Maven | netty | io.netty:netty-codec-xml |
>= 4.2.0.Final, < 4.2.16.Final >= 4.1.0.Final, < 4.1.136.Final Fix: upgrade to 4.2.16.Final
|
| Debian:11 | debian | netty | All versions |
| Debian:12 | debian | netty | All versions |
| Debian:13 | debian | netty | All versions |
| Debian:14 | debian | netty | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | netty | All versions |
Original advisory text
Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
References
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final URL
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final URL
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b Patch
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 Patch
- https://github.com/advisories/GHSA-4qhr-g3c6-fcfx
- https://security-tracker.debian.org/tracker/CVE-2026-56817 Vendor Advisory
- https://github.com/netty/netty Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56817... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56817 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-56817 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-56817 Third Party Advisory
- https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-611XML External Entity (XXE)
Timeline
Published21 Jul 2026
Updated4 Nov 2026
First seen21 Jul 2026
Sources
DEBIAN-CVE-2026-56817 · OSV
UBUNTU-CVE-2026-56817 · OSV
CVE-2026-56817 · NVD
CVE-2026-56817 · MITRE
GHSA-4qhr-g3c6-fcfx · GHSA
GHSA-4qhr-g3c6-fcfx · OSV
CVE-2026-56817 · OSV
Track software like this
Free during beta