CVE-2026-59901
EUVD-2026-5044029.07.2026, 18:16
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| netty | netty | 𝑥 < 4.1.136 |
| netty | netty | 4.2.0 ≤ 𝑥 < 4.2.16 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| netty-tcnative |
|
Common Weakness Enumeration
Vulnerability Media Exposure