CVE-2026-73507
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Netty before versions 4.1.136.Final and 4.2.16.Final has a vulnerability in XmlFrameDecoder.decode() that fails to preserve closing-tag parser state across invocations. An unauthenticated remote attacker can trickle-feed repeated </ sequences, causing repeated rescans of the accumulated buffer and exhausting an EventLoop thread's CPU, leading to denial of service with a maxFrameLength of 1 MB.
Risk Assessment
The vulnerability allows remote denial of service, potentially disrupting applications using Netty and affecting service availability.
Recommendation
Update Netty to version 4.1.136.Final or 4.2.16.Final, which contain the fix.
Original NVD description (English source)
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, causing denial of service with a maxFrameLength of 1 MB. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.