CVE-2026-56817

Summary

Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling

Severity

high

EPSS

0.7% (p53)

CWE

CWE-611

Also known as

GHSA-4qhr-g3c6-fcfx

Published

2026-07-22

Updated

2026-07-22

Advisory details

Any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a confirmed misconfiguration with conditional exploitability.

References

• https://github.com/advisories/GHSA-4qhr-g3c6-fcfx
• https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx
• https://nvd.nist.gov/vuln/detail/CVE-2026-56817
• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final

Related advisories

• GHSA-v74w-7mr3-4qg3 — high · Maven/io.netty:netty-codec-xml
• CVE-2026-61741 — critical · Maven/org.http4s:http4s-scala-xml_2.12
• APPSEC-XXE — critical · Web app/XML External Entity injection
• CVE-2026-61586 — high · Maven/eu.copernik:copernik-xml-factory
• CVE-2026-61570 — high · Maven/net.sf.mpxj:mpxj
• CVE-2026-55848 — high · Maven/org.mapfish.print:print-lib
• CVE-2026-54078 — high · Maven/org.verapdf:validation-model
• CVE-2026-54079 — high · Maven/org.verapdf:validation-model

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity