CVE-2026-56817: Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
Any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a confirmed misconfiguration with conditional exploitability.
Other sources
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to an AsyncXMLInputFactory instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty:netty-codec-xmlto a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
maven/io.netty:netty-codec-xmlto a version that resolves this vulnerability.Fixed in 4.2.16.Final - Upgrade
Upgrade
Nettyto a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
Nettyto a version that resolves this vulnerability.Fixed in 4.2.16.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56817?
CVE-2026-56817 has a risk score of 47, indicating a moderate severity level.
What is CVE-2026-56817?
CVE-2026-56817 is a vulnerability in Netty that allows XML External Entity (XXE) injection due to unconfigured XML factory settings.
How do I fix CVE-2026-56817?
To mitigate CVE-2026-56817, ensure that DTD and entity processing are disabled in the XML factory settings.
Which versions of Netty are affected by CVE-2026-56817?
CVE-2026-56817 affects Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final.
What kind of attacks can CVE-2026-56817 lead to?
CVE-2026-56817 can allow attackers to perform XXE injection attacks, potentially leading to unauthorized access to sensitive files.