Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling

🗓️ 22 Jul 2026 21:43:16Reported by GitHub Advisory DatabaseType

Netty XmlDecoder with an unconfigured XML factory enables injection; entity resolution varies.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2026-56817	22 Jul 202602:10	–	circl
CVE	CVE-2026-56817	21 Jul 202622:06	–	cve
Cvelist	CVE-2026-56817 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled	21 Jul 202622:06	–	cvelist
Debian CVE	CVE-2026-56817	21 Jul 202622:06	–	debiancve
EUVD	EUVD-2026-47579	22 Jul 202621:43	–	euvd
NVD	CVE-2026-56817	21 Jul 202623:17	–	nvd
OSV	CVE-2026-56817 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled	21 Jul 202622:06	–	osv
OSV	DEBIAN-CVE-2026-56817	21 Jul 202623:17	–	osv
OSV	GHSA-4QHR-G3C6-FCFX Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling	22 Jul 202621:43	–	osv
OSV	MINI-JQHP-JGVQ-F5FH	23 Jul 202613:35	–	osv

Vulners

Node

io.netty netty-codec-xmlRange4.1.0.Final–4.1.135.Finalmaven

io.netty netty-codec-xmlRange4.2.0.Final–4.2.15.Finalmaven

Source	Link
github	www.github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56817
github	www.github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
github	www.github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
github	www.github.com/netty/netty/releases/tag/netty-4.1.136.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.16.Final
github	www.github.com/advisories/GHSA-4qhr-g3c6-fcfx

22 Jul 2026 21:43Current

5.3Medium risk

Vulners AI Score5.3

CVSS 48.3

EPSS0.00555

SSVC