CVE-2026-56817 is a critical (CVSS 9.8) XML external entity risk in Netty's XmlDecoder. Affected versions are 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final. Upgrade to 4.1.136.Final or 4.2.16.Final, and check any pipeline that decodes XML. The advisory calls the exploitability conditional, so check whether your pipelines use XmlDecoder.
What's affected
The Netty advisory (GHSA-4qhr-g3c6-fcfx) lists the Maven package io.netty:netty-codec-xml. Affected: 4.1.0.Final through 4.1.135.Final, and 4.2.0.Final through 4.2.15.Final. Patched: 4.1.136.Final and 4.2.16.Final.
Only applications that put XmlDecoder in a channel pipeline are in scope. The advisory says any caller who can deliver bytes to that pipeline can send XML with a DOCTYPE declaration to a parser created with no security configuration. Whether external entities are actually resolved depends on how the Aalto XML async parser behaves, so the advisory calls the exploitability conditional.
Netty published the fixes in the 4.1.136.Final and 4.2.16.Final releases.
How to check if you're exposed
Netty usually arrives as a transitive dependency, so look at the resolved tree.
mvn dependency:tree -Dincludes=io.netty
./gradlew dependencies | grep netty
- Look for netty-codec-xml. If it is absent, XmlDecoder is not on your classpath.
- If it is present, search your code for XmlDecoder in channel pipelines.
- Check shaded jars and container images, where the dependency tree may not show it.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade Netty to 4.1.136.Final or 4.2.16.Final, and pin the version in dependency management so that transitive pulls cannot bring back an older one.
- Rebuild fat jars and container images, then redeploy.
- Search for XmlDecoder in pipelines and note which ones accept data from untrusted peers.
- Where you cannot upgrade yet, keep untrusted callers away from pipelines that decode XML.
- Add a regression check to your build that fails if an affected Netty version appears.
Why it matters
The weakness is CWE-611, improper restriction of XML external entity reference. An XML parser that processes a DOCTYPE with entity handling switched on can be told to fetch local files or remote resources named by the document. Safe parsers disable DTDs and external entities by default.
Here the parser was created with no security configuration, so the safe settings were left to chance. The advisory is careful to say the effect depends on the underlying parser. That is honest, and it is also why a patch is cheaper than analysis. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I use Netty only for HTTP?
The advisory ties the issue to pipelines that contain XmlDecoder. If netty-codec-xml is not used, the vulnerable code is not reached, but keep Netty current anyway.
Sources
Last reviewed: 19 October 2026.
