Skip to content
Threat Feed
Subscribe

Product

Netty-Codec-Compression (>= 4.2.0.Final, < 4.2.16.Final)

1 brief RSS
medium advisory

Netty Bzip2Decoder Infinite Loop Vulnerability Leads to Event-Loop Thread Hang (CVE-2026-59901)

A denial-of-service vulnerability exists in the `Bzip2Decoder` handler within Netty's `netty-codec-compression` and `netty-codec` libraries, allowing a remote attacker to exploit CVE-2026-59901 by providing a specially crafted bzip2 stream, which causes an infinite loop in the run-length encoding state machine, leading to the permanent hang of an event-loop thread and application denial of service.

netty-codec-compression +1 denial-of-service vulnerability netty
1t