CyberRota Analysis
AI-GeneratedThe vulnerability affects the Netty framework's XmlFrameDecoder, which fails to maintain parser state, allowing unauthenticated remote attackers to exploit this flaw by sending crafted sequences that can lead to CPU exhaustion and denial of service. Organizations using affected versions prior to 4.1.136.Final and 4.2.16.Final should prioritize patching to mitigate the risk of service disruption. This is particularly critical for applications relying on Netty for network communication.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, causing denial of service with a maxFrameLength of 1 MB. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.