Résumé
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
Détails de l’avis
Any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a confirmed misconfiguration with conditional exploitability.
Références
- https://github.com/advisories/GHSA-4qhr-g3c6-fcfx
- https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx
- https://nvd.nist.gov/vuln/detail/CVE-2026-56817
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-55848
MapFish Print has XXE that allows reading arbitrary files of certain types
- MEDIUMCVE-2026-54082
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
- HIGHCVE-2026-54078
veraPDF Validation XXE via Rich Text
- HIGHCVE-2026-54079
veraPDF Validation XXE via XFA
- HIGHGHSA-7q9c-hpx7-9cwm
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
- CRITICALCVE-2026-73842
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation