Netty CVE-2026-59901

Netty is a widely used asynchronous, event-driven network application framework for the JVM, underpinning many Java servers, proxies, and frameworks (e.g. gRPC, Elasticsearch, Cassandra, Spring reactive stacks). Its compression codec module implements a pure-Java bzip2 decompressor; the affected component is the run-length encoding (RLE) state machine inside Bzip2BlockDecompressor.read(). The root cause is CWE-835 (Loop with Unreachable Exit Condition, 'Infinite Loop'): a malformed RLE sequence drives the state machine into a state from which the loop's exit condition can never be satisfied, so the decode call never returns. Because Netty processes channel data on a small, shared event-loop thread pool, a single hung decode permanently consumes that thread. The two affected Maven coordinates reflect Netty's branch layout - pkg:maven/io.netty:netty-codec on the 4.1.x line and pkg:maven/io.netty:netty-codec-compression on the 4.2.x line - where the bzip2 codec was split into the dedicated compression artifact in 4.2.