RHLW-2026-f00b5fbbbb907153
- Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-f00b5fbbbb907153.json
- Import Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-f00b5fbbbb907153.json
- JSON Data
- https://api.osv.dev/v1/vulns/RHLW-2026-f00b5fbbbb907153
- Upstream
CVE (2)
- Published
- 2026-10-12T16:58:03Z
- Modified
- 2026-10-27T04:00:21Z
- Severity
-
- 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Lightwell Security Advisory: netty-codec-xml 4.1.100.Final-rhlw-00001
- Details
-
Red Hat Lightwell has released io.netty:netty-codec-xml 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-56817 and CVE-2026-73507.
CVE-2026-56817: Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
CVE-2026-73507: Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
This patched artifact is a drop-in replacement for io.netty:netty-codec-xml 4.1.100.Final from Maven Central.
- References
-
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56817.json
- https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx
- https://nvd.nist.gov/vuln/detail/CVE-2026-56817
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/advisories/GHSA-4qhr-g3c6-fcfx
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73507.json
- https://github.com/netty/netty/security/advisories/GHSA-v74w-7mr3-4qg3
- https://nvd.nist.gov/vuln/detail/CVE-2026-73507
- https://github.com/advisories/GHSA-v74w-7mr3-4qg3
- Credits
-
-
- Red Hat Lightwell - REMEDIATION_DEVELOPER
-
Affected packages
Red Hat Lightwell:Maven / io.netty:netty-codec-xml
Package
- Name
- io.netty:netty-codec-xml
- Purl
- pkg:maven/io.netty/netty-codec-xml
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed4.1.100.Final-rhlw-00001
Affected versions
4.*
4.1.0.Beta4
4.1.0.Beta5
4.1.0.Beta6
4.1.0.Beta7
4.1.0.Beta8
4.1.0.CR1
4.1.0.CR2
4.1.0.CR3
4.1.0.CR4
4.1.0.CR5
4.1.0.CR6
4.1.0.CR7
4.1.0.Final
4.1.1.Final
4.1.2.Final
4.1.3.Final
4.1.4.Final
4.1.5.Final
4.1.6.Final
4.1.7.Final
4.1.8.Final
4.1.9.Final
4.1.10.Final
4.1.11.Final
4.1.12.Final
4.1.13.Final
4.1.14.Final
4.1.15.Final
4.1.16.Final
4.1.17.Final
4.1.18.Final
4.1.19.Final
4.1.20.Final
4.1.21.Final
4.1.22.Final
4.1.23.Final
4.1.24.Final
4.1.25.Final
4.1.26.Final
4.1.27.Final
4.1.28.Final
4.1.29.Final
4.1.30.Final
4.1.31.Final
4.1.32.Final
4.1.33.Final
4.1.34.Final
4.1.35.Final
4.1.36.Final
4.1.37.Final
4.1.38.Final
4.1.39.Final
4.1.40.Final
4.1.41.Final
4.1.42.Final
4.1.43.Final
4.1.44.Final
4.1.45.Final
4.1.46.Final
4.1.47.Final
4.1.48.Final
4.1.49.Final
4.1.50.Final
4.1.51.Final
4.1.52.Final
4.1.53.Final
4.1.54.Final
4.1.55.Final
4.1.56.Final
4.1.57.Final
4.1.58.Final
4.1.59.Final
4.1.60.Final
4.1.61.Final
4.1.62.Final
4.1.63.Final
4.1.64.Final
4.1.65.Final
4.1.66.Final
4.1.67.Final
4.1.68.Final
4.1.69.Final
4.1.70.Final
4.1.71.Final
4.1.72.Final
4.1.73.Final
4.1.74.Final
4.1.75.Final
4.1.76.Final
4.1.77.Final
4.1.78.Final
4.1.79.Final
4.1.80.Final
4.1.81.Final
4.1.82.Final
4.1.83.Final
4.1.84.Final
4.1.85.Final
4.1.86.Final
4.1.87.Final
4.1.88.Final
4.1.89.Final
4.1.90.Final
4.1.91.Final
4.1.92.Final
4.1.93.Final
4.1.94.Final
4.1.95.Final
4.1.96.Final
4.1.97.Final
4.1.98.Final
4.1.99.Final
4.1.100.Final
Database specific
lightwell
{
"backport_base_version": "4.1.100.Final",
"remediated_version": "4.1.100.Final-rhlw-00001",
"repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-f00b5fbbbb907153.json"