CVE-2026-59901: 
Java Análisis y mitigación de vulnerabilidades

CVE-2026-59901 is a denial-of-service vulnerability in Netty's Bzip2Decoder compression codec handler that allows unauthenticated remote attackers to permanently freeze an event-loop thread via a malformed bzip2 stream. It affects all Netty versions prior to 4.1.136.Final and versions 4.2.0.Final through 4.2.15.Final. The vulnerability was disclosed on July 22, 2026, via GitHub Advisory GHSA-558v-64gr-wgg4, and patches were released in versions 4.1.136.Final and 4.2.16.Final (GitHub Advisory). It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). The vulnerability resides in the run-length encoding (RLE) state machine within Bzip2BlockDecompressor.read(), which is invoked by the Bzip2Decoder handler in Netty's compression codec pipeline. A remote attacker can craft a malformed bzip2 stream that causes the RLE state machine to enter an infinite loop, permanently occupying the event-loop thread and preventing it from processing any further I/O events. No authentication or user interaction is required, and the attack complexity is low (GitHub Advisory).

Successful exploitation results in a complete denial of service for the affected Netty-based application. Because Netty's event-loop threads handle all I/O for the server, permanently blocking a thread causes the service to become unresponsive to all subsequent network requests. There is no confidentiality or integrity impact; the sole consequence is high availability impact, potentially requiring a service restart to recover (GitHub Advisory).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.246%, indicating a low probability of exploitation in the near term. The attack is classified as automatable (no user interaction, no authentication required), which lowers the barrier for opportunistic exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of the time of this report.

1. Reconnaissance: Identify internet-facing services built on Netty that accept bzip2-compressed data (e.g., HTTP servers with bzip2 content-encoding support, custom TCP services using Netty's compression pipeline) running versions prior to 4.1.136.Final or 4.2.16.Final.
2. Craft malformed bzip2 stream: Construct a specially crafted bzip2 payload that triggers an infinite loop in the RLE state machine within Bzip2BlockDecompressor.read() — for example, a stream with a malformed RLE sequence that the state machine cannot exit.
3. Deliver payload: Send the malformed bzip2 stream to the target service over the network (e.g., as the body of an HTTP request with Content-Encoding: bzip2, or as raw data to a TCP endpoint using Netty's Bzip2Decoder in its pipeline).
4. Achieve denial of service: The Bzip2Decoder handler processes the malformed stream, causing the event-loop thread to spin indefinitely, rendering the service unable to handle any further requests until the process is restarted (GitHub Advisory).

• Network: Unexpected or repeated inbound connections sending bzip2-compressed payloads to Netty-based services; connections that remain open without completing a response cycle.
• Process: Netty event-loop threads showing 100% CPU utilization for an extended period with no corresponding throughput; Java thread dumps revealing a thread stuck in Bzip2BlockDecompressor.read() or related RLE state machine code.
• Logs: Application logs showing no new requests being processed after a specific timestamp; absence of expected periodic log output from the Netty server indicating thread starvation.
• Availability: Service health checks or monitoring alerts indicating the application has stopped responding to new connections despite the JVM process remaining alive.

Upgrade Netty to version 4.1.136.Final or 4.2.16.Final, which contain the fix for this vulnerability (GitHub Advisory, Netty 4.2.16 Release, Netty 4.1.136 Release). As a temporary workaround, disable bzip2 compression support in the Netty pipeline if it is not required for operations. Additionally, consider deploying upstream request filtering or a reverse proxy that validates or rejects malformed compressed content before it reaches the Netty application. SUSE has also released a security update (SUSE-SU-2026:3482-1) for affected packages in their ecosystem.

The Netty project released patched versions (4.1.136.Final and 4.2.16.Final) promptly and published the advisory via GitHub Security Advisories (GitHub Advisory). SUSE issued a security update (SUSE-SU-2026:3482-1) for downstream packages, and Tenable published Nessus detection plugins (IDs 330708 and 332130) to assist with identification of vulnerable systems. AusCERT also issued a bulletin (ESB-2026.9084) referencing the vulnerability. Community reaction has been measured, consistent with a well-understood DoS class vulnerability with a clear patch available and no active exploitation.