https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:51:19 +0000 https://db.gcve.eu/vuln/ghsa-v74w-7mr3-4qg3 <p><strong>Affected:</strong> Maven: io.netty:netty-codec-xml</p> <p>### Summary An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated `&lt;/` characters) to a Netty server utilizing XmlFrameDecoder, causing the server&#39;s EventLoop thread to exhaust CPU resources and become unresponsive.</p> <p>### Details `io.netty.handler.codec.xml.XmlFrameDecoder` suffers from a vulnerability resulting in CPU exhaustion. When `&lt;` followed by `/` is encountered, the decoder scans the remaining buffer for a closing `&gt;`. Because the parser state is not saved between `decode()` invocations, an attacker can trickle-feed a payload of `&lt;/` characters. This forces the decoder to repeatedly rescan the entire accumulated buffer. A 1MB `maxFrameLength` is enough to completely hang a server&#39;s thread while it loops endlessly.</p> <p>### Impact Denial of Service via CPU Exhaustion. Any application utilizing Netty&#39;s XmlFrameDecoder is impacted. An unauthenticated remote attacker can exploit this flaw by sending a modest amount of malformed XML data to an exposed port.</p> <p><strong>Affected:</strong> Maven: io.netty:netty-codec-xml</p> <p>### Summary An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated `&lt;/` characters) to a Netty server utilizing XmlFrameDecoder, causing the server&#39;s EventLoop thread to exhaust CPU resources and become unresponsive.</p> <p>### Details `io.netty.handler.codec.xml.XmlFrameDecoder` suffers from a vulnerability resulting in CPU exhaustion. When `&lt;` followed by `/` is encountered, the decoder scans the remaining buffer for a closing `&gt;`. Because the parser state is not saved between `decode()` invocations, an attacker can trickle-feed a payload of `&lt;/` characters. This forces the decoder to repeatedly rescan the entire accumulated buffer. A 1MB `maxFrameLength` is enough to completely hang a server&#39;s thread while it loops endlessly.</p> <p>### Impact Denial of Service via CPU Exhaustion. Any application utilizing Netty&#39;s XmlFrameDecoder is impacted. An unauthenticated remote attacker can exploit this flaw by sending a modest amount of malformed XML data to an exposed port.</p> https://db.gcve.eu/vuln/ghsa-v74w-7mr3-4qg3