CVE-2026-56817
io.netty/netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (high), Ubuntu (medium).
Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| chainguard | apache-hop, apache-hop-fips, celeborn-0.5 and 9 more | 2.18.1-r8 and 10 more |
| debian 11 | netty | no fix listed |
| debian 12 | netty | no fix listed |
| debian 13 | netty | no fix listed |
| debian 14 | netty | no fix listed |
| echo | netty | no fix listed |
| maven::GitHub Security Advisory Maven | io.netty:netty-codec-xml | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop, apache-hop-fips, datahub-frontend-react and 7 more | 2.19.0-r0 and 4 more |
| rapidfort debian 12 | netty | no fix listed |
| rapidfort debian 13 | netty | no fix listed |
| Red Hat | netty-codec-xml | no fix listed |
| ubuntu 20.04-ESM | netty | no fix listed |
Show all 38 entries from 15 sources
| Source | Package | Fixed in |
|---|---|---|
| chainguard | apache-hop | 2.18.1-r8 |
| chainguard | apache-hop-fips | 2.18.1-r6 |
| chainguard | celeborn-0.5 | 0.5.4-r30 |
| chainguard | celeborn-0.6 | 0.6.3-r11 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r3 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| chainguard | pinot | 1.5.1-r4 |
| chainguard | pinot-fips | 1.5.1-r4 |
| chainguard | seata | 2.6.0-r21 |
| chainguard | tez | 0.10.5-r23 |
| chainguard | thingsboard | 4.3.1.3-r7 |
| chainguard | tinkerpop | 3.8.1-r2 |
| debian 11 | netty | no fix listed |
| debian 12 | netty | no fix listed |
| debian 13 | netty | no fix listed |
| debian 14 | netty | no fix listed |
| echo | netty | no fix listed |
| maven::GitHub Security Advisory Maven | io.netty:netty-codec-xml | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop | 2.19.0-r0 |
| minimos | apache-hop-fips | 2.19.0-r0 |
| minimos | datahub-frontend-react | 1.7.0-r0 |
| minimos | datahub-frontend-react-fips | 1.7.0-r0 |
| minimos | datahub-upgrade | 1.7.0-r0 |
| minimos | datahub-upgrade-fips | 1.7.0-r0 |
| minimos | management-api-5.0 | 0.1.124-r0 |
| minimos | management-api-fips-5.0 | 0.1.124-r0 |
| minimos | trino | 483-r0 |
| minimos | trino-fips | 483-r2 |
| rapidfort debian 12 | netty | no fix listed |
| rapidfort debian 13 | netty | no fix listed |
| Red Hat | netty-codec-xml | no fix listed |
| ubuntu 20.04-ESM | netty | no fix listed |
| ubuntu 22.04 | netty | no fix listed |
| ubuntu 24.04 | netty | no fix listed |
| wolfi | celeborn-0.6 | 0.6.3-r11 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| wolfi | tez | 0.10.5-r23 |
| wolfi | thingsboard | 4.3.1.3-r7 |
References
- https://access.redhat.com/security/cve/CVE-2026-56817
- https://github.com/netty/netty
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
- https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx
- https://nvd.nist.gov/vuln/detail/CVE-2026-56817