CVE-2026-59901

Analyzed Analyzed - Analysis Complete

Denial-of-Service in Netty via Malformed Bzip2 Stream

Publication date: 2026-07-29

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-06

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-59901

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	to 4.1.136 (exc)
netty	netty	From 4.2.0 (inc) to 4.2.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability affects Netty, a network application framework. The Bzip2Decoder handler in its compression codec pipeline can be exploited by a malformed bzip2 stream. This causes the event-loop thread to enter an infinite loop, leading to a denial-of-service condition.

Detection Guidance

Detecting this vulnerability requires checking if your Netty version is affected. Use commands like 'find / -name "netty*.jar" 2>/dev/null' to locate Netty JAR files, then run 'java -jar <jar-file> -version' to check the version. If the version is below 4.1.136.Final or 4.2.16.Final, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability can cause your application to become unresponsive or crash due to the infinite loop in the event-loop thread. This disrupts normal operations and may lead to service unavailability.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt network services handling sensitive data. A prolonged event-loop thread lock due to malformed bzip2 streams may lead to service unavailability, potentially violating availability requirements in GDPR Article 32 and HIPAA Security Rule Section 164.308(a)(7).

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or 4.2.16.Final or later. If upgrading is not immediately possible, remove or disable the Bzip2Decoder handler from the compression codec pipeline to prevent the attack vector.

Hi! I’m here to help you understand CVE-2026-59901. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70