CVE-2026-73507

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description An unauthenticated remote attacker can cause a denial of service by sending repeated </ sequences to the decode() function within io.netty.handler.codec.xml.XmlFrameDecoder. This occurs because the function fails to preserve the closing-tag parser state across invocations, leading to repeated rescanning of the accumulated buffer. This process exhausts the CPU of an EventLoop thread when a maxFrameLength of 1 MB is used.

Recommendations Update to version 4.1.136.Final. Update to version 4.2.16.Final.