Bug 2507481 (CVE-2026-59901)

Summary:	CVE-2026-59901 io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abrianik, anujha, asoldano, bbaranow, bmaxwell, bstansbe, chfoley, dlofthou, ggrzybek, istudens, ivassile, iweiss, jraez, kaycoth, mosmerov, msvehla, nwallace, parichar, pberan, pesilva, pjindal, pmackay, rgodfrey, rstancel, sdawley, swoodman, tasato, thjenkin, vdosoudi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the netty-codec-compression component of Netty. This vulnerability, caused by a logic error in the bzip2 decoder, allows a remote attacker to send specially crafted bzip2-compressed data. Processing this malformed data can trigger an infinite loop, causing the decoder thread to consume excessive CPU resources. This leads to a denial of service (DoS), requiring manual intervention to restore service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-27 14:37:30 UTC

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final, the bzip2 decoder in netty-codec-compression contains a logic error that can cause infinite loops when processing certain malformed or adversarial bzip2-compressed data. An attacker can send specially crafted bzip2 payloads that trigger the infinite loop condition, causing the decoder thread to consume 100% CPU until manual intervention, leading to denial of service. This issue is fixed in versions 4.1.136.Final and later.

Comment 1 Jon Orris 2026-09-21 12:20:33 UTC

This issue has been addressed in the following products:

  Red Hat Data Grid 8.6.3

Via RHSA-2026:69296 https://access.redhat.com/errata/RHSA-2026:69296