CVEFinder.io

CVE-2026-73507

⚠️ high
Summary

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, causing denial of service with a maxFrameLength of 1 MB. This issue is fixed in versions 4.1.136.Final a

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, causing denial of service with a maxFrameLength of 1 MB. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Score
7.5
High
EPSS Score
0.8
Exploit Probability
Published Date
2026-08-13
First Seen: 2026-08-14
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 67.8% of all 365,890 vulnerabilities in our database.

#117,965
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 15, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-09-23
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)
CWE-400

📦 Affected Products 2

Vendor Product Status Affected Versions
netty netty Affected
< 4.1.136
netty netty Affected
> 4.2.0 < 4.2.16

🔗 References 5

https://github.com/netty/netty/commit/5b68c61f37aa4a...
Patch
https://github.com/netty/netty/commit/bb2ff68a1fb71c...
Patch
https://github.com/netty/netty/releases/tag/netty-4....
Release Notes
https://github.com/netty/netty/releases/tag/netty-4....
Release Notes
https://github.com/netty/netty/security/advisories/G...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-89044 🔶 medium 6.5 0.4 Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the f... 2026-09-10
CVE-2026-62380 ⚠️ high 7.5 0.3 Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain nul... 2026-08-22
CVE-2026-75595 ⛔ critical 9.1 0.5 Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.h... 2026-08-19
CVE-2026-75596 ⚠️ high 7.5 0.7 Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the defau... 2026-08-19
CVE-2026-59902 ⚠️ high 7.5 0.7 Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.... 2026-08-17
CVE-2026-59903 🔶 medium 6.5 0.3 Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.... 2026-08-17
These CVEs affect the same products