CVE-2026-56817: Netty XmlDecoder XXE Vulnerability

CVE-2026-56817 Overview

CVE-2026-56817 is an XML External Entity (XXE) vulnerability in Netty, a network application framework widely used to build protocol servers and clients on the JVM. The flaw affects the XmlDecoder handler, which instantiates an AsyncXMLInputFactory from the Aalto XML parser without applying a hardening configuration. Any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration, leaving DTD and entity handling active. This creates a conditional XXE risk depending on Aalto async parser behavior. Affected releases include 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. Netty has published fixes in 4.1.136.Final and 4.2.16.Final.

Critical Impact
Remote, unauthenticated attackers who can send XML to a pipeline using XmlDecoder may trigger external entity resolution, enabling confidential file disclosure and internal network reconnaissance.

Affected Products

Netty 4.2.0.Final through 4.2.15.Final
Netty 4.1.0.Final through 4.1.135.Final
Any application embedding io.netty.handler.codec.xml.XmlDecoder in its channel pipeline

Discovery Timeline

2026-07-21 - CVE-2026-56817 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-56817

Vulnerability Analysis

The defect resides in Netty's XmlDecoder, which delegates XML parsing to Aalto XML's AsyncXMLInputFactory. The decoder creates the factory without disabling DTD processing or external entity resolution. When a client submits XML containing a <!DOCTYPE ...> declaration with an external entity reference, the async parser may resolve that entity against the local file system or a network endpoint. This aligns with [CWE-611: Improper Restriction of XML External Entity Reference].

Exploitation depends on how Aalto XML resolves entities in async mode, which makes the risk conditional but still exploitable in configurations where entity expansion proceeds. Because Netty is embedded in numerous middleware, gateway, and messaging products, downstream applications inherit the unsafe defaults.

Root Cause

The root cause is a missing secure-processing configuration on the AsyncXMLInputFactory instance. Standard hardening requires setting SUPPORT_DTD to false, disabling IS_SUPPORTING_EXTERNAL_ENTITIES, and enabling FEATURE_SECURE_PROCESSING. The vulnerable XmlDecoder constructor omits these calls, so the factory operates with permissive defaults inherited from the parser library.

Attack Vector

The vulnerability is reachable over the network with no authentication and no user interaction. An attacker constructs an XML payload carrying a DOCTYPE declaration that references an external entity, such as file:///etc/passwd or an attacker-controlled HTTP endpoint. If the target pipeline includes XmlDecoder, the parser attempts to resolve the entity during decoding. The response data can then be exfiltrated in error messages, side channels, or subsequent outbound requests depending on downstream application logic.

Because the code samples released in the fix commits (5b68c61f and bb2ff68a) span multiple codec hardening changes across Netty modules, the specific XmlDecoder remediation is documented in the GitHub Security Advisory GHSA-4qhr-g3c6-fcfx. Refer to the advisory for the exact factory configuration applied in the patched releases.

Detection Methods for CVE-2026-56817

Indicators of Compromise

Inbound XML payloads that contain <!DOCTYPE or <!ENTITY declarations arriving on services built on Netty.
Unexpected outbound DNS or HTTP callbacks from JVM processes shortly after receiving XML input.
Java process reads of sensitive local files such as /etc/passwd, /proc/self/environ, or Windows configuration files that do not match normal application behavior.
Netty runtime version reported as any release between 4.1.0.Final–4.1.135.Final or 4.2.0.Final–4.2.15.Final in dependency inventories.

Detection Strategies

Inspect HTTP and TCP traffic to Netty-based services for XML bodies containing DOCTYPE or ENTITY tokens using WAF or IDS signatures.
Perform software composition analysis (SCA) across build artifacts and container images to flag vulnerable io.netty:netty-codec-xml versions.
Correlate JVM process telemetry with unexpected filesystem reads and outbound network connections that follow XML input events.

Monitoring Recommendations

Enable application-level logging of parsed XML root elements and reject payloads containing DTDs at the ingress layer.
Monitor egress traffic from application servers for connections to non-approved destinations, which can indicate out-of-band XXE data exfiltration.
Track dependency drift by alerting when a Netty version below 4.1.136.Final or 4.2.16.Final is introduced into a build.

How to Mitigate CVE-2026-56817

Immediate Actions Required

Upgrade Netty to 4.1.136.Final or 4.2.16.Final across all production and pre-production environments.
Audit application pipelines for XmlDecoder usage and confirm the underlying netty-codec-xml artifact version.
Block or strip XML payloads containing DOCTYPE declarations at gateways and WAFs until patching completes.
Rotate credentials or secrets that may have been readable by the JVM process if evidence of exploitation is found.

Patch Information

Netty maintainers released fixed versions netty-4.1.136.Final and netty-4.2.16.Final. The remediation is described in GitHub Security Advisory GHSA-4qhr-g3c6-fcfx and is delivered through commits 5b68c61f and bb2ff68a. The patched decoder configures the AsyncXMLInputFactory to disable DTDs and external entity resolution.

Workarounds

Remove XmlDecoder from channel pipelines if XML parsing is not required by the application.
Wrap or replace XmlDecoder with a custom handler that instantiates AsyncXMLInputFactory with SUPPORT_DTD=false and IS_SUPPORTING_EXTERNAL_ENTITIES=false.
Enforce ingress filtering at reverse proxies to reject requests whose bodies contain <!DOCTYPE or <!ENTITY tokens.

bash

# Maven dependency override to enforce the patched Netty release
mvn versions:use-dep-version \
  -Dincludes=io.netty:netty-codec-xml \
  -DdepVersion=4.1.136.Final \
  -DforceVersion=true

# Gradle equivalent
./gradlew dependencies --refresh-dependencies \
  -Pnetty.version=4.2.16.Final