Denial of Service Vulnerability in Netty Framework by Vendor Netty
CVE-2026-73507
7.5HIGH
What is CVE-2026-73507?
In prior versions of the Netty framework (4.1.135.Final and earlier, 4.2.15.Final and earlier), a flaw in the XmlFrameDecoder's decoding function allowed unauthenticated remote attackers to exploit a failure in preserving closing-tag parser state. By sending repeated sequences of closing tags repeatedly, attackers could trigger excessive rescanning of the accumulated buffer. This condition could lead to a denial of service by exhausting an EventLoop thread's CPU resources. The vulnerability has been addressed in the releases 4.1.136.Final and 4.2.16.Final, ensuring that the parser state is effectively managed across invocations.
Affected Version(s)
netty < 4.1.136.Final < 4.1.136.Final
netty >= 4.2.0.Final, < 4.2.16.Final < 4.2.0.Final, 4.2.16.Final