Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

Timeline

Scores

EPSS (exploitation in 30 days)

0.46% · top 60% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

• CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)All about CWE-835 and its CVEs

Affected products

• netty · netty

  • affected >=4.2.0.Final, < 4.2.16.Final
  • affected < 4.1.136.Final

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenio.netty:netty-codecGHSA-558v-64gr-wgg4 (opens in a new tab)
• Mavenio.netty:netty-codec-compressionGHSA-558v-64gr-wgg4 (opens in a new tab)

References (1)

• https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4 (opens in a new tab)x_refsource_CONFIRM

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-558v-64gr-wgg4 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-59901](https://trackcve.app/badge/CVE-2026-59901.svg)](https://trackcve.app/cve/CVE-2026-59901)

Record last updated 29 Jul 2026, 18:09 UTC.