GHSA-v74w-7mr3-4qg3: Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated </ characters) to a Netty server utilizing XmlFrameDecoder, causing the server’s EventLoop thread to exhaust CPU resources and become unresponsive.
References
- github.com/advisories/GHSA-v74w-7mr3-4qg3
- github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- github.com/netty/netty/pull/17063
- github.com/netty/netty/pull/17065
- github.com/netty/netty/releases/tag/netty-4.1.136.Final
- github.com/netty/netty/releases/tag/netty-4.2.16.Final
- github.com/netty/netty/security/advisories/GHSA-v74w-7mr3-4qg3
Code Behaviors & Features
Detect and mitigate GHSA-v74w-7mr3-4qg3 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →