Netty, a Java network application framework, can be abused when it processes XML messages with the XmlDecoder handler and an AsyncXMLInputFactory that has not been explicitly secured. The factory defaults permit DTD and external entity handling, allowing an attacker to embed XML with a DOCTYPE declaration that resolves to external entities. This flaw, identified as CWE‑611, can lead to sensitive file disclosure from the server environment or even execution of arbitrary code if the external entity triggers such behavior. The vulnerability is manifest in Netty versions 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final, all of which contain the unguarded XmlDecoder.

The vendor netty:netty publishes the affected library. Any application that includes Netty in these version ranges and that routes inbound XML data through the XmlDecoder in its channel pipeline is susceptible. Both the 4.1.x line up to 4.1.135 and the 4.2.x line up to 4.2.15 are affected; the issue is resolved in 4.1.136.Final and 4.2.16.Final.

The CVSS score of 8.3 denotes high severity, while the EPSS score of less than 1% suggests that active exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog. To trigger the flaw an attacker must communicate with a service that accepts XML over a network connection, a typical remote delivery vector. Given the low exploitation probability but high potential impact, the recommendation is to remediate promptly by applying the vendor’s fixed releases.