Overview
About vulnerability
Summary
An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated </ characters) to a Netty server utilizing XmlFrameDecoder, causing the server’s EventLoop thread to exhaust CPU resources and become unresponsive.
Details
io.netty.handler.codec.xml.XmlFrameDecoder suffers from a vulnerability resulting in CPU exhaustion. When < followed by / is encountered, the decoder scans the remaining buffer for a closing >.
Because the parser state is not saved between decode() invocations, an attacker can trickle-feed a payload of </ characters. This forces the decoder to repeatedly rescan the entire accumulated buffer. A 1MB maxFrameLength is enough to completely hang a server’s thread while it loops endlessly.
Impact
Denial of Service via CPU Exhaustion. Any application utilizing Netty’s XmlFrameDecoder is impacted. An unauthenticated remote attacker can exploit this flaw by sending a modest amount of malformed XML data to an exposed port.
Details
- Affected product:
- Apache CXF , Apache Hadoop , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Eclipse Jetty , Elasticsearch , Netty , Spring , Wildfly , alluxio , amqp-10-jms-spring-boot , artemis , async-http-client , aws-sdk-java , aws-sdk-java-v2 , azure-sdk-for-java , azure-search-documents , bolt-connection-java , bookkeeper , bookkeeper-common-allocator , camel , cassandra-java-driver , corda , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , curator , cypher-dsl , distributedlog , flink , flink-shaded , flume , grpc-java , infinispan , java-driver , lettuce , logging-flume , micrometer , micronaut-core , neo4j-java-driver , neo4j-ogm , pinecone-java-client , pulsar , qpid-jms , rabbitmq-stream-java-client , redisson , rsocket-java , tika , zookeeper
- Affected packages:
- Spring Integration @ 5.5.19 (+12193 more)