CVE-2026-59901

Summary

Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

Severity

high

EPSS

0.5% (p40)

CWE

CWE-835

Also known as

GHSA-558v-64gr-wgg4#io.netty:netty-codec-compression

Published

2026-07-22

Updated

2026-07-22

Advisory details

The Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [Bzip2BlockDecompressor.read()]

References

• https://github.com/advisories/GHSA-558v-64gr-wgg4
• https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final

Related advisories

• CVE-2026-42583 — high · Maven/io.netty:netty-codec-compression
• CVE-2025-58057 — medium · Maven/io.netty:netty-codec-compression
• CVE-2026-96642 — high · PyPI/Pillow
• CVE-2026-112406 — high · PyPI/Pillow
• CVE-2026-112390 — high · PyPI/Pillow
• CVE-2026-97370 — high · Maven/com.github.junrar:junrar
• GHSA-6w6g-hm98-mhgm — high · crates.io/hickory-resolver
• CVE-2026-19484 — high · npm/@fastify/busboy

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity