highCVE-2026-59901Jul 22, 2026

CVE-2026-59901: Netty Bzip2Decoder Infinite Loop DoS

Rohit Hatagale
AI Security Researcher, SecureLayer7

A crafted bzip2 stream can permanently hang the Netty event-loop thread by trapping it in an infinite loop inside the run-length encoding decoder, taking the entire server offline with a single…

Packageio.netty:netty-codec-compression
Ecosystemmaven
Affected>= 4.2.0.Final, < 4.2.16.Final
Fixed in4.2.16.Final

The problem

Netty's Bzip2Decoder (in netty-codec-compression 4.2.x and netty-codec 4.1.x) passes incoming bytes to Bzip2BlockDecompressor.read() on the event-loop thread. The RLE state machine inside that method loops to produce output bytes one at a time. It never yields back to the caller when a specially crafted repeat-count is provided, so the thread spins forever.

Because Netty is event-driven, one stuck event-loop thread means every connection sharing that thread stops being served. A single unauthenticated TCP request carrying a malformed bzip2 block is enough to cause a full denial of service.

The fix

Upgrade to io.netty:netty-codec-compression 4.2.16.Final (or io.netty:netty-codec 4.1.136.Final for the 4.1 branch). There is no configuration workaround; the only option short of patching is to remove Bzip2Decoder from the pipeline entirely if bzip2 support is not required.

Reported by normanmaurer (Norman Maurer, Netty maintainer).

References: [1][2][3][4]

Related research