Skip to main content

Netty EUVDEUVD-2026-50440

| CVE-2026-59901 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-07-22 https://github.com/netty/netty GHSA-558v-64gr-wgg4
Denial Of Service
8.7
CVSS 4.0 · Vendor: https://github.com/netty/netty
Share

Severity by source

Vendor (https://github.com/netty/netty) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Remotely reachable bzip2 decode with no auth or interaction and low complexity (single crafted stream); impact is pure availability (thread hang), so C:N/I:N/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (https://github.com/netty/netty).

CVSS VectorVendor: https://github.com/netty/netty

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Analysis Updated
Jul 29, 2026 - 18:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 29, 2026 - 18:22 vuln.today
cvss_changed
CVSS changed
Jul 29, 2026 - 18:22 NVD
8.7 (HIGH)
Source Code Evidence Fetched
Jul 22, 2026 - 22:22 vuln.today
Analysis Generated
Jul 22, 2026 - 22:22 vuln.today
CVE Published
Jul 22, 2026 - 21:50 cve.org
HIGH

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 4,199 maven packages depend on io.netty:netty-codec (48 direct, 4,151 indirect)
  • 842 maven packages depend on io.netty:netty-codec-compression (4 direct, 838 indirect)

Ecosystem-wide dependent count for version 4.1.136.Final and other introduced versions.

DescriptionCVE.org

The Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [Bzip2BlockDecompressor.read()]

AnalysisAI

Denial of service in Netty's bzip2 compression codec allows remote unauthenticated attackers to permanently hang an event-loop thread by sending a malformed bzip2 stream, affecting applications that use the Bzip2Decoder in netty-codec (< 4.1.136.Final) or netty-codec-compression (>= 4.2.0.Final, < 4.2.16.Final). The flaw is an infinite loop (CWE-835) in the run-length-encoding state machine of Bzip2BlockDecompressor.read(), which never terminates on crafted input and starves the shared Netty I/O thread pool. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.

Technical ContextAI

Netty is a widely used asynchronous, event-driven network application framework for the JVM, underpinning many Java servers, proxies, and frameworks (e.g. gRPC, Elasticsearch, Cassandra, Spring reactive stacks). Its compression codec module implements a pure-Java bzip2 decompressor; the affected component is the run-length encoding (RLE) state machine inside Bzip2BlockDecompressor.read(). The root cause is CWE-835 (Loop with Unreachable Exit Condition, 'Infinite Loop'): a malformed RLE sequence drives the state machine into a state from which the loop's exit condition can never be satisfied, so the decode call never returns. Because Netty processes channel data on a small, shared event-loop thread pool, a single hung decode permanently consumes that thread. The two affected Maven coordinates reflect Netty's branch layout - pkg:maven/io.netty:netty-codec on the 4.1.x line and pkg:maven/io.netty:netty-codec-compression on the 4.2.x line - where the bzip2 codec was split into the dedicated compression artifact in 4.2.

RemediationAI

Vendor-released patch: upgrade to Netty 4.1.136.Final (for io.netty:netty-codec, https://github.com/netty/netty/releases/tag/netty-4.1.136.Final) or Netty 4.2.16.Final (for io.netty:netty-codec-compression, https://github.com/netty/netty/releases/tag/netty-4.2.16.Final), matching your release line; check transitive dependencies since Netty is frequently pulled in indirectly. If you cannot patch immediately, the most effective compensating control is to remove or avoid adding Bzip2Decoder to your ChannelPipeline so bzip2 streams are never decoded - trade-off: clients relying on bzip2 content encoding will break, though bzip2 is rarely required and other codecs (gzip/deflate) are usually available. Alternatively, terminate/upstream-filter bzip2 content at a proxy or reject requests advertising bzip2 encoding, and bound decompression on isolated worker threads rather than the shared event loop to limit blast radius. Full advisory: https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

Share

EUVD-2026-50440 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy