The vulnerable component, io.netty.handler.codec.xml.XmlFrameDecoder.decode(), fails to retain closing-tag parser state across invocations, allowing an unauthenticated remote attacker to repeatedly feed a sequence of "</" characters. This causes the decoder to rescanned the buffer on each call, exhausting the CPU of an EventLoop thread and resulting in a denial of service when the maximum frame length (1 MB) is reached. The weakness is categorized as a resource exhaustion flaw (CWE‑400).

The issue affects Netty versions prior to 4.1.136.Final and 4.2.16.Final. Any application using the Netty framework, without additional safeguards, is susceptible. Upgrading to 4.1.136.Final or later, or to 4.2.16.Final or later, resolves the defect.

With a CVSS score of 7.5, the vulnerability represents a high severity denial of service risk. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the lack of authentication or input validation makes it possible for any remote party to trigger the attack. The exploit requires only repeated network traffic containing the trigger pattern, making it trivial for an attacker to abuse the flaw. The vulnerability is not currently listed in the CISA KEV catalog, but the high impact warrants immediate action.