AIKIDO-2026-389134
netty-codec-xml is vulnerable to XML External Entity (XXE) Attack
83
High Risk
This Affects:
netty-codec-xmlTL;DR
Affected versions of this package instantiate the Aalto XML parser used by XmlDecoder with no security configuration, leaving DTD support and entity reference handling enabled. Any remote caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can submit XML with a DOCTYPE declaration; depending on Aalto's async parser behavior, external entities may be resolved, enabling XXE-style attacks such as local file disclosure, server-side request forgery, or denial of service. Patched releases disable DTD support and entity reference replacement in the shared parser factory.
Who does this affect?
You are affected if you are using a version within the vulnerable range and your application exposes a Netty channel pipeline that includes XmlDecoder to process untrusted XML input.
Background info
netty-codec-xml is vulnerable to XML External Entity (XXE) Attack in versions 4.1.0.Final - 4.1.135.Final and 4.2.0.Final - 4.2.15.Final.
How to fix this
Upgrade the io.netty:netty-codec-xml library to the patch version.
Links
GitHub Releases
Fix Commits
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant