CVE-2026-59901: Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [Bzip2BlockDecompressor.read()]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty:netty-codecto a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
maven/io.netty:netty-codec-compressionto a version that resolves this vulnerability.Fixed in 4.2.16.Final - Upgrade
Upgrade
Netty compression codec (Bzip2Decoder / Bzip2BlockDecompressor)to a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
Netty compression codec (Bzip2Decoder / Bzip2BlockDecompressor)to a version that resolves this vulnerability.Fixed in 4.2.16.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59901?
CVE-2026-59901 has a risk score of 37, indicating a medium severity level.
How do I fix CVE-2026-59901?
To fix CVE-2026-59901, update to the patched versions of Netty: netty-4.1.136.Final or netty-4.2.16.Final.
What kind of attack does CVE-2026-59901 facilitate?
CVE-2026-59901 facilitates a denial-of-service attack through a malformed bzip2 stream.
Which components are affected by CVE-2026-59901?
CVE-2026-59901 affects the Bzip2Decoder handler in Netty's compression codec pipeline.
When was CVE-2026-59901 published?
CVE-2026-59901 was published on July 22, 2026.