CVE-2026-59901 in Netty
Summary
by MITRE • 07/29/2026
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in Netty's Bzip2Decoder handler represents a critical denial-of-service weakness that can be exploited through malformed bzip2 streams to permanently block event-loop threads. This flaw affects versions prior to 4.1.136.Final and 4.2.16.Final of the network application framework, which is widely used for building high-performance asynchronous applications. The vulnerability specifically targets the run-length encoding state machine implementation within the Bzip2BlockDecompressor.read() method, creating a condition where maliciously crafted bzip2 data can cause threads to become trapped in infinite loops.
The technical root cause lies in the improper handling of bzip2 stream decompression logic within Netty's compression codec pipeline. When the Bzip2Decoder processes malformed input data, it enters an infinite loop during the run-length encoding state machine execution, causing the event-loop thread to consume 100% CPU resources without making progress. This behavior occurs because the decompressor fails to properly validate or limit the iteration count in its state machine logic, allowing malicious input to trigger unbounded looping conditions that persist until the application is terminated.
From an operational perspective, this vulnerability creates significant risk for applications relying on Netty's compression capabilities, as it can be exploited by attackers to perform resource exhaustion attacks against network services. The infinite loop condition means that a single malicious connection or data packet can effectively disable service availability, making it particularly dangerous in high-traffic environments where multiple concurrent connections could be simultaneously compromised. The attack requires minimal effort from an adversary since the malformed stream can be constructed using standard bzip2 encoding techniques that appear legitimate to basic validation checks.
The vulnerability aligns with CWE-835, which addresses infinite loops in software implementations, and represents a classic example of how compression algorithm implementations can introduce denial-of-service vectors through inadequate input validation. From an attack framework perspective, this weakness maps to ATT&CK technique T1499.004, specifically targeting network denial-of-service conditions through resource exhaustion attacks. The impact extends beyond simple service disruption to potentially enabling broader exploitation scenarios where attackers can leverage the persistent thread blocking to conduct more sophisticated attacks or maintain persistent service degradation.
Organizations should prioritize upgrading to Netty versions 4.1.136.Final or 4.2.16.Final to address this vulnerability, as these releases contain proper bounds checking and loop termination logic within the Bzip2BlockDecompressor implementation. Additional mitigations include implementing input validation layers before decompression operations, monitoring for unusual CPU consumption patterns on event-loop threads, and configuring rate limiting or connection throttling mechanisms to limit exposure. Security teams should also consider implementing intrusion detection systems that can identify malformed bzip2 traffic patterns and automated alerting for sustained high-CPU conditions on affected services.