Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-23 | 1 | Patch1 |
| 2026-07-29 | 2 | Disclosure2 |
| 2026-08-08 | 1 | Disclosure1 |
| 2026-08-09 | 1 | Patch1 |
1/7｜给使用 Netty 处理压缩数据的团队：解析器抛异常不可怕，更危险的是既不返回、也不失败，还占着事件循环线程。 Netty 近期公开的高危修复提醒：流式解析器必须证明每一步都在有界前进。 CVE-2026-59901｜仅分析公开补丁 👇
Post summary
The message highlights Netty CVE‑2026‑59901, explains the denial‑of‑service flaw caused by a non‑terminating stream parser, and points to the publicly available patch that resolves the issue.
🔴 (Netty) Bzip2Decoder Infinite Loop Denial-of-Service - #CVE-2026-59901 (High) -DC-Aug2026-1479 https://dailycve.com/netty-bzip2decoder-infinite-loop-denial-of-service-cve-2026-59901-high-dc-aug2026-1479/
Post summary
The post announces a new high‑severity CVE-2026-59901 for Netty's Bzip2Decoder that can lead to an infinite loop DoS attack; no PoC or patch details are provided.
🚨*CVE* CVE-2026-59901 Netty is an asynchronous, event-driven network application framework. Prior to versions http://4.1.136.Final and http://4.2.16.Final, the `Bzip2Decoder` handler in Netty's compress… https://www.cve.org/CVERecord?id=CVE-2026-59901 ----- Traducció… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-59901, highlighting its impact on Netty’s Bzip2Decoder handler and the affected versions, but provides no PoC, exploit, or patch information.
CVE-2026-59901 Netty is an asynchronous, event-driven network application framework. Prior to versions http://4.1.136.Final and http://4.2.16.Final, the `Bzip2Decoder` handler in Netty's compress… https://www.cve.org/CVERecord?id=CVE-2026-59901
Post summary
Netty’s Bzip2Decoder handler was found vulnerable in all releases before 4.1.136.Final and 4.2.16.Final; upgrading to these or newer patches the issue.
🚨High - Netty Bzip2Decoder Infinite Loop Denial of Service (CVE-2026-59901) Netty's Bzip2Decoder can be forced into an infinite loop by a malformed bzip2 stream. The run-length-encoding state machine in http://Bzip2BlockDecompressor.read() never reaches its exit condition, permanently capturing the Netty event-loop thread. Because Netty services share a small pool of event-loop threads, hanging one blocks processing of other connections on that loop - an unauthenticated, low-complexity remote denial of service. Impact is availability only, and only affects services that decode bzip2 input via Netty. CVSS 8.7. 👉Upgrade netty-codec to http://4.1.136.Final, or netty-codec-compression to http://4.2.16.Final.
Post summary
Netty’s Bzip2Decoder suffers an unauthenticated infinite‑loop denial of service (CVSS 8.7); the issue is mitigated by upgrading to the specified netty‑codec releases.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | netty | netty | - | - | - |