Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, causing denial of service with a maxFrameLength of 1 MB. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T15:20:17.287Z",
  "pubdate": "2026-08-13T15:20:17.287Z",
  "executiveSummary": "A denial of service vulnerability exists within the Netty asynchronous, event-driven network application framework, specifically affecting the XML decoding handler. The vulnerability arises from a failure to properly preserve closing-tag parser state across invocations within the decoding logic, enabling an unauthenticated remote attacker to trigger excessive CPU consumption.\nBy continuously sending carefully crafted sequences to the target application, a remote threat actor can repeatedly force the parser to rescan the accumulated buffer up to the configured maximum frame length. This computational overhead completely exhausts the allocated EventLoop thread's CPU resources, rendering the service unresponsive to legitimate traffic.\nThe flaw impacts Netty versions prior to 4.1.136.Final and 4.2.16.Final. Exploitation requires network access to a service utilizing the vulnerable XML frame decoder. Because the attack vector can be executed remotely without prior authentication or special privileges, it presents a significant risk to availability for applications processing untrusted XML streams over network sockets.",
  "technicalDetails": "The vulnerability is localized to the io.netty.handler.codec.xml.XmlFrameDecoder.decode() function within the Netty framework. The root cause of the flaw is the improper management and persistence of the closing-tag parser state across successive method invocations during the decoding process of incoming network byte streams.\nThe vulnerable component processes incoming data by accumulating bytes into an internal buffer up to a defined maxFrameLength, which defaults or can be configured up to 1 MB. During the parsing lifecycle, the decoder evaluates structural XML tokens to identify frame boundaries. Due to the state preservation failure, the parser fails to maintain its contextual position when encountering malformed or partial XML fragments.\nAn unauthenticated remote attacker can exploit this behavior by establishing a network connection and utilizing a trickle-feed delivery mechanism. The attacker transmits repeated closing-tag sequences, such as </ sequences, at a controlled rate. Upon receiving each fragment, the io.netty.handler.codec.xml.XmlFrameDecoder.decode() implementation attempts to parse the input but loses its contextual continuity from the previous invocation.\nConsequently, the parser repeatedly rescans the entire accumulated byte buffer from the beginning for every newly received trickle-fed fragment. This algorithmic inefficiency transforms the operation into a CPU-intensive bottleneck. Because Netty relies on an asynchronous event-driven architecture utilizing single-threaded EventLoop execution models for network I/O, pinning a thread to this intensive rescanning loop blocks the entire EventLoop.\nThe attack flow proceeds as follows: 1. The attacker connects to the network service and provisions a continuous trickle of specific byte sequences. 2. The Netty application passes the stream to io.netty.handler.codec.xml.XmlFrameDecoder.decode(). 3. The decoder fails to retain parser state for closing tags, triggering a full buffer rescan on every tick. 4. The EventLoop thread reaches 100 percent CPU utilization processing redundant parsing operations. 5. The application experiences a complete denial of service as the affected EventLoop thread fails to service other network channels.\nThe affected versions include all Netty releases prior to 4.1.136.Final and 4.2.16.Final. No authentication or elevated privileges are required to initiate the network payloads, and the impact is strictly localized to causing a denial of service via resource exhaustion without facilitating remote code execution or data exfiltration."
}