CVE-2026-59901: Netty Bzip2Decoder infinite loop denial of service

CVE-2026-59901 · Severity: high · CVSS 4 · Published 2026-07-29

Netty, a widely used framework for building high-performance network applications, contains a flaw in how it handles compressed data. An attacker can send a specially crafted data stream that forces the application into an infinite loop, effectively freezing the service. This results in a denial-of-service, making the application unresponsive to legitimate users and potentially impacting business operations.

Technologies: io.netty:netty-codec (Maven), io.netty:netty-codec-compression (Maven). Vendors: Maven, Netty.

Quick answers

Is CVE-2026-59901 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59901 being exploited in the wild.
How severe is CVE-2026-59901?
High severity, with a CVSS score of 4, published 29 July 2026.
Which products and versions are affected?
io.netty:netty-codec (Maven) < 4.1.136.Final, ECOSYSTEM:introduced=0,fixed=4.1.136.Final; io.netty:netty-codec-compression (Maven) >= 4.2.0.Final, < 4.2.16.Final, ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final; Netty-Codec < 4.1.136.Final; Netty-Codec-Compression >= 4.2.0.Final, < 4.2.16.Final.
Is there a fix for CVE-2026-59901?
Yes. io.netty:netty-codec (Maven): upgrade to 4.1.136.Final or later; io.netty:netty-codec-compression (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59901 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59901?
Check whether you run io.netty:netty-codec (Maven), io.netty:netty-codec-compression (Maven), Netty-Codec or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec (Maven): upgrade to 4.1.136.Final or later
    # set io.netty:netty-codec to 4.1.136.Final in your pom.xml or build.gradle
  • io.netty:netty-codec-compression (Maven): upgrade to 4.2.16.Final or later
    # set io.netty:netty-codec-compression to 4.2.16.Final in your pom.xml or build.gradle

Technical details

A vulnerability exists in the Bzip2Decoder handler within Netty's compression codec pipeline. The flaw is located in the run-length encoding (RLE) state machine within the Bzip2BlockDecompressor.read() method. By providing a malformed bzip2 stream, a remote unauthenticated attacker can trigger an infinite loop (CWE-835) that permanently captures the event-loop thread. Because Netty relies on a non-blocking event-driven model, hanging an event-loop thread can lead to a complete denial of service for all connections handled by that thread. The issue is resolved in versions 4.1.136.Final and 4.2.16.Final.

Affected products

  • Netty netty-codec < 4.1.136.Final
  • Netty netty-codec-compression >= 4.2.0.Final, < 4.2.16.Final

Identifiers

  • CVE-2026-59901
  • GHSA-558v-64gr-wgg4

Timeline

  • 2026-07-14: advisory: GitHub Security Advisory published
  • 2026-07-29: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.