GHSA-v74w-7mr3-4qg3
Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
Summary
### Summary An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated ` `. Because the parser state is not saved between `decode()` invocations, an attacker can trickle-feed a payload of `</` characters. This forces the decoder to repeatedly rescan the entire accumulated buffer. A 1MB `maxFrameLength` is enough to completely hang a server's thread while it loops endlessly. ### Impact Denial of Service via CPU Exhaustion. Any application utilizing Netty's XmlFrameDecoder is impacted. An unauthenticated remote attacker can exploit this flaw by sending a modest amount of malformed XML data to an exposed port.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| Maven | io.netty:netty-codec-xml | — | 4.2.16.Final, 4.1.136.Final |
Remediation: Upgrade to 4.2.16.Final or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.