Bug 2507481 (CVE-2026-59901) - CVE-2026-59901 io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)
Summary: CVE-2026-59901 io.netty/netty-codec-compression: Netty: Infinite loop in nett...
Keywords:
Status: NEW
Alias: CVE-2026-59901
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-27 14:37 UTC by OSIDB Bzimport
Modified: 2026-09-21 12:20 UTC (History)
29 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:69296 0 None None None 2026-09-21 12:20:35 UTC

Description OSIDB Bzimport 2026-07-27 14:37:30 UTC 
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final, the bzip2 decoder in netty-codec-compression contains a logic error that can cause infinite loops when processing certain malformed or adversarial bzip2-compressed data. An attacker can send specially crafted bzip2 payloads that trigger the infinite loop condition, causing the decoder thread to consume 100% CPU until manual intervention, leading to denial of service. This issue is fixed in versions 4.1.136.Final and later.
Comment 1 Jon Orris 2026-09-21 12:20:33 UTC 
This issue has been addressed in the following products:

  Red Hat Data Grid 8.6.3

Via RHSA-2026:69296 https://access.redhat.com/errata/RHSA-2026:69296
Note You need to log in before you can comment on or make changes to this bug.