Log in Start free

Vulnerability · Published Jul 29, 2026 · Assigned by GitHub_M

CVE-2026-59901Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

High 8.7

In plain English

A high-severity infinite loop in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.5%top 60.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nettyno fix listedDEBIAN-CVE-2026-59901
Debian:13nettyno fix listedDEBIAN-CVE-2026-59901
Debian:14nettyno fix listedDEBIAN-CVE-2026-59901
Mavenio.netty:netty-codec4.1.136.FinalGHSA-558v-64gr-wgg4
Mavenio.netty:netty-codec-compression4.2.16.FinalGHSA-558v-64gr-wgg4
Ubuntu:26.10nettyno fix listedUBUNTU-CVE-2026-59901

Affected products (as reported)

VendorProductVersions
netty netty >=4.2.0.Final, < 4.2.16.Final< 4.1.136.Final

Weakness: CWE-835 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References