io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)

🗓️ 12 Aug 2026 19:35:14Reported by RedHatType

Bzip2 decoder in Netty netty-codec-compression has a logic error causing an infinite loop and CPU exhaustion denial of service.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: Vulnerabilities reported in netty-codec-4.1.135.Final.jar for APIM	4 Oct 202617:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	19 Aug 202618:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec	16 Sep 202619:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by a denial-of-service vulnerability in Netty	27 Aug 202617:09	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)	28 Sep 202614:25	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple security vulnerability in IBM Maximo Asset Management application	17 Sep 202606:29	–	ibm
attackerkb	CVE-2026-59901	29 Jul 202617:48	–	attackerkb
Atlassian	DoS (Denial of Service) io.netty:netty-codec Dependency in Bamboo Data Center	7 Aug 202616:32	–	atlassian
Atlassian	DoS (Denial of Service) Netty Dependency in Confluence Data Center	2 Sep 202608:31	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec Dependency in Crowd Data Center	1 Aug 202604:31	–	atlassian

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-59901
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59901
cve	www.cve.org/CVERecord

03 Oct 2026 10:13Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

CVSS 48.7

EPSS0.0046

SSVC