Infinite loop denial-of-service in Netty Bzip2Decoder (CVE-2026-59901)

The `Bzip2Decoder` handler in Netty's compression codec pipeline contains a flaw in the run-length encoding (RLE) state machine within `Bzip2BlockDecompressor.read()`. A remote attacker can send a malformed bzip2 stream that causes the event-loop thread to enter an infinite loop, permanently hanging it and rendering the affected service unresponsive. Affected versions: - io.netty:netty-codec < 4.1.136.Final - io.netty:netty-codec-compression >= 4.2.0.Final, < 4.2.16.Final We recommend updating to: io.netty:netty-codec 4.1.136.Final, io.netty:netty-codec-compression 4.2.16.Final. CVSS 8.7 · our assessment: this_week Reference: https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4 Details: https://vuln.today/cve/CVE-2026-59901