PT-2026-63549 · Maven · Io.Netty:Netty-Codec+1

CVE-2026-59901 · Publicado 2026-07-22 · Atualizado 2026-07-22

OSV

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

The Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [Bzip2BlockDecompressor.read()]

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2026-59901

GHSA-558V-64GR-WGG4

Produtos afetados

Io.Netty:Netty-Codec

Io.Netty:Netty-Codec-Compression

Referências · 5

• https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4 · Nota
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Nota
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Nota
• https://github.com/netty/netty · Nota
• https://osv.dev/vulnerability/GHSA-558v-64gr-wgg4 · Aviso do Fabricante