Io.netty:netty codec compression: Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang (CVE-2026-59901)
The Bzip2Decoder handler in the Netty compression codec pipeline has a vulnerability that allows a denial-of-service condition by causing an infinite loop in the run-length encoding state machine. This infinite loop can permanently hang the event-loop thread when processing a malformed bzip2 stream. The issue affects the Bzip2BlockDecompressor.read() method and results in high-severity impact due to the potential for service disruption.
AI Analysis
Technical Summary
CVE-2026-59901 is a denial-of-service vulnerability in the io.netty:netty-codec-compression library, specifically in the Bzip2Decoder handler. The vulnerability arises from an infinite loop in the run-length encoding (RLE) state machine within the Bzip2BlockDecompressor.read() method when processing a malformed bzip2 stream. This causes the event-loop thread to hang indefinitely, leading to a denial-of-service condition. The vulnerability has a high severity rating and no known exploits in the wild have been reported. No patch or remediation details are currently available.
Potential Impact
An attacker can send a specially crafted malformed bzip2 stream that triggers an infinite loop in the RLE state machine of the Bzip2Decoder. This causes the event-loop thread to hang permanently, resulting in denial of service by blocking event processing in applications using this codec. The impact is a high-severity disruption of service availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider avoiding processing untrusted bzip2 compressed data with the vulnerable Netty codec compression component to mitigate risk.
Io.netty:netty codec compression: Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang (CVE-2026-59901)
Description
The Bzip2Decoder handler in the Netty compression codec pipeline has a vulnerability that allows a denial-of-service condition by causing an infinite loop in the run-length encoding state machine. This infinite loop can permanently hang the event-loop thread when processing a malformed bzip2 stream. The issue affects the Bzip2BlockDecompressor.read() method and results in high-severity impact due to the potential for service disruption.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59901 is a denial-of-service vulnerability in the io.netty:netty-codec-compression library, specifically in the Bzip2Decoder handler. The vulnerability arises from an infinite loop in the run-length encoding (RLE) state machine within the Bzip2BlockDecompressor.read() method when processing a malformed bzip2 stream. This causes the event-loop thread to hang indefinitely, leading to a denial-of-service condition. The vulnerability has a high severity rating and no known exploits in the wild have been reported. No patch or remediation details are currently available.
Potential Impact
An attacker can send a specially crafted malformed bzip2 stream that triggers an infinite loop in the RLE state machine of the Bzip2Decoder. This causes the event-loop thread to hang permanently, resulting in denial of service by blocking event processing in applications using this codec. The impact is a high-severity disruption of service availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider avoiding processing untrusted bzip2 compressed data with the vulnerable Netty codec compression component to mitigate risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-558v-64gr-wgg4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59901"]
- Ecosystems
- ["Maven"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a6150d39c2644c7f8da06d8
Added to database: 07/22/2026, 23:22:59 UTC
Last enriched: 07/22/2026, 23:29:55 UTC
Last updated: 07/23/2026, 02:06:25 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.