CVE-2026-59901 netty CVE debrief

Who should care

Users of Netty versions prior to 4.1.136.Final or 4.2.16.Final should be aware of this vulnerability and take necessary actions to mitigate it. Affected operators, platforms, and security teams should review system configurations, assess potential impacts, and implement compensating controls as needed.

Technical summary

A denial-of-service vulnerability exists in the Bzip2Decoder handler of Netty's compression codec pipeline. The vulnerability is caused by a malformed bzip2 stream that can permanently capture the event-loop thread in an infinite loop. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final. Affected systems should prioritize updates to prevent potential attacks. The vulnerability exists in the run-length encoding (RLE) state machine within Bzip2BlockDecompressor.read(). Affected product context includes Netty versions prior to 4.1.136.Final or 4.2.16.Final. Defensive impact includes potential service disruption and system instability. Source-grounded technical framing confirms that the vulnerability is a result of a malformed bzip2 stream.

Defensive priority

High-priority defensive actions are required due to the high CVSS score of 8.7. Affected systems should be updated to versions 4.1.136.Final or 4.2.16.Final as soon as possible.

Recommended defensive actions

• Update Netty to version 4.1.136.Final or 4.2.16.Final
• Implement compensating controls to detect and prevent potential attacks
• Monitor systems for unusual activity
• Perform inventory checks to identify affected systems
• Exception tracking and retest procedures should be in place
• Review system configurations for potential exposure
• Verify vendor-supported updates or mitigations through normal change control

Evidence notes

The vulnerability exists in the run-length encoding (RLE) state machine within Bzip2BlockDecompressor.read(). Evidence is based on official CVE and NVD records, as well as a vendor advisory. Affected systems may have exposure to denial-of-service attacks. Defenders should verify system configurations, review vendor advisories, and assess potential impacts on their specific environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.