highCVE-2026-56817Jul 22, 2026

CVE-2026-56817: netty-codec-xml XmlDecoder XML External Entity Injection

Rohit Hatagale
AI Security Researcher, SecureLayer7

Netty's XmlDecoder uses an unconfigured XML parser that leaves DTD and external entity processing enabled by default, letting any attacker who can send bytes into the pipeline attempt to read server…

Packageio.netty:netty-codec-xml
Ecosystemmaven
Affected>= 4.2.0.Final, <= 4.2.15.Final
Fixed in4.2.16.Final

The problem

XmlDecoder creates its Aalto XML parser factory as a bare new InputFactoryImpl() with no security properties applied. DTD support and external entity resolution are on by default, so any XML that reaches the decoder can carry a DOCTYPE declaration.

An attacker with network access to the channel can inject a payload to probe or exfiltrate data via the parser. Whether full entity resolution fires depends on Aalto's async feed behavior, but the misconfiguration is confirmed and the parser surface is exposed.

Proof of concept

A working proof-of-concept for CVE-2026-56817 in io.netty:netty-codec-xml, with the exact payload below.

text
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

The root cause is a single static field initializer: private static final AsyncXMLInputFactory XML_INPUT_FACTORY = new InputFactoryImpl();. No properties are set before any stream reader is created, so SUPPORT_DTD and IS_SUPPORTING_EXTERNAL_ENTITIES remain at their Aalto defaults (enabled).

The patch adds explicit hardening calls on the factory before use: setProperty(XMLInputFactory.SUPPORT_DTD, false) and setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false). This matches CWE-611: the parser accepted external entity references because the application never told it not to.

The fix

Upgrade to io.netty:netty-codec-xml version 4.2.16.Final (or 4.1.136.Final for the 4.1.x line). No workaround exists within the affected versions short of removing XmlDecoder from your pipeline and performing your own hardened XML parsing.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research