CVE-2026-73507

About vulnerability

Summary

An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated </ characters) to a Netty server utilizing XmlFrameDecoder, causing the server’s EventLoop thread to exhaust CPU resources and become unresponsive.

Details

io.netty.handler.codec.xml.XmlFrameDecoder suffers from a vulnerability resulting in CPU exhaustion. When < followed by / is encountered, the decoder scans the remaining buffer for a closing >. Because the parser state is not saved between decode() invocations, an attacker can trickle-feed a payload of </ characters. This forces the decoder to repeatedly rescan the entire accumulated buffer. A 1MB maxFrameLength is enough to completely hang a server’s thread while it loops endlessly.

Impact

Denial of Service via CPU Exhaustion. Any application utilizing Netty’s XmlFrameDecoder is impacted. An unauthenticated remote attacker can exploit this flaw by sending a modest amount of malformed XML data to an exposed port.

Affected product:

Apache CXF , Apache Hadoop , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Eclipse Jetty , Elasticsearch , Hazelcast , Netty , Spring , Wildfly , alluxio , amazon-dynamodb-lock-client , amazon-kinesis-client , amazon-kinesis-producer , amqp-10-jms-spring-boot , arrow , artemis , async-http-client , athenz , avro , aws-glue-schema-registry , aws-lakeformation-accessgrants-plugin-java-v2 , aws-s3-accessgrants-plugin-java-v2 , aws-sdk-java , aws-sdk-java-v2 , azure-kusto-java , azure-sdk-for-java , azure-search-documents , azure-spring-data-cosmos , bolt-connection-java , bookkeeper , camel , cassandra-java-driver , corda , corda-api , couchbase-jvm-clients , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , curator , cypher-dsl , debezium , docker-java , etcd4j , flink , flink-shaded , flume , google-cloud-java , grpc-java , hbase , hbase-thirdparty , http-client , infinispan , io.quarkus:quarkus-credentials-deployment , io.quarkus:quarkus-datasource-deployment-spi , io.quarkus:quarkus-resteasy , jaeger-analytics-java , java-driver , jena , jersey , jetcd , kinesis-logback-appender , lettuce , logging-flume , logging-flume-irc , metrics , micrometer , micronaut-core , neo4j , neo4j-java-driver , neo4j-ogm , olingo-odata4 , opencensus-java , org.apache.ratis:ratis-thirdparty-misc , pgjdbc-ng , pinecone-java-client , pravega , pulsar , pulsar-client-reactive , qpid-jms , quarkus , rabbitmq-java-client , rabbitmq-stream-java-client , ratis , redisson , rsocket-java , sdk-platform-java , smallrye-common , smallrye-mutiny-vertx-bindings , strimzi-kafka-operator , tika , tinkerpop , vert.x , vertx-auth , vertx-eventbus-bridges , vertx-grpc , vertx-kafka-client , vertx-web , zendesk-java-client , zookeeper

Affected packages:

netty-transport-native-epoll @ 4.1.73.Final (+19355 more)