CVE-2026-73507: Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, causing denial of service with a maxFrameLength of 1 MB. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:nettyto a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
io.netty:nettyto a version that resolves this vulnerability.Fixed in 4.2.16.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73507?
CVE-2026-73507 has a severity rating of high with a score of 7.5.
How do I fix CVE-2026-73507?
To fix CVE-2026-73507, upgrade to Netty versions 4.1.136.Final or 4.2.16.Final or later.
What is the impact of CVE-2026-73507?
CVE-2026-73507 can lead to a denial of service due to CPU exhaustion caused by an unauthenticated remote attacker.
Which versions of Netty are affected by CVE-2026-73507?
CVE-2026-73507 affects versions of Netty prior to 4.1.136.Final and 4.2.16.Final.
What component of Netty is vulnerable in CVE-2026-73507?
The vulnerability in CVE-2026-73507 is in the io.netty.handler.codec.xml.XmlFrameDecoder component.