| Package | Affected versions | Patched versions |
|---|---|---|
| io.netty:netty-codec-xml | ≥ 4.2.0.Final, < 4.2.16.Final< 4.1.136.Final | 4.2.16.Final4.1.136.Final |
| netty | ≥ 4.2.0, < 4.2.16< 4.1.136 | 4.2.164.1.136 |
An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated </ characters) to a Netty server utilizing XmlFrameDecoder, causing the server's EventLoop thread to exhaust CPU resources and become unresponsive.
io.netty.handler.codec.xml.XmlFrameDecoder suffers from a vulnerability resulting in CPU exhaustion. When < followed by / is encountered, the decoder scans the remaining buffer for a closing >.
Because the parser state is not saved between decode() invocations, an attacker can trickle-feed a payload of </ characters. This forces the decoder to repeatedly rescan the entire accumulated buffer. A 1MB maxFrameLength is enough to completely hang a server's thread while it loops endlessly.
Denial of Service via CPU Exhaustion. Any application utilizing Netty's XmlFrameDecoder is impacted. An unauthenticated remote attacker can exploit this flaw by sending a modest amount of malformed XML data to an exposed port.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free