CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

🗓️ 29 Jul 2026 17:48:39Reported by GitHub_MType

CVE-2026-59901: Netty Bzip2Decoder RLE loop may hang the event loop; fixed in 4.1.136 and 4.2.16.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	19 Aug 202618:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec	16 Sep 202619:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by a denial-of-service vulnerability in Netty	27 Aug 202617:09	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)	28 Sep 202614:25	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple security vulnerability in IBM Maximo Asset Management application	17 Sep 202606:29	–	ibm
attackerkb	CVE-2026-59901	29 Jul 202617:48	–	attackerkb
Atlassian	DoS (Denial of Service) io.netty:netty-codec Dependency in Bamboo Data Center	7 Aug 202616:32	–	atlassian
Atlassian	DoS (Denial of Service) Netty Dependency in Confluence Data Center	2 Sep 202608:31	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec Dependency in Crowd Data Center	1 Aug 202604:31	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec Dependency in Jira Service Management Data Center	6 Aug 202617:31	–	atlassian

[
  {
    "vendor": "netty",
    "product": "netty",
    "versions": [
      {
        "version": ">=4.2.0.Final, < 4.2.16.Final",
        "status": "affected"
      },
      {
        "version": "< 4.1.136.Final",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4

29 Jul 2026 17:48Current

CVSS 48.7

EPSS0.0046

SSVC

CWE-835