CVE-2026-59901: netty Infinite Loop

CVSS: 8.7v4.0HighAnalyzed

AliasesUBUNTU-CVE-2026-59901DEBIAN-CVE-2026-59901CGA-23h8-jj3f-4xc5+941 more

Published 29-07-2026Last modified 29-07-2026

Vulnerability summary

CVE-2026-59901 is a high (CVSS 8.7) Infinite Loop vulnerability in netty. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.4% of scored vulnerabilities.

Overall risk

35/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.7/10

010

High · v4.0 (CVE.org)

EPSS score

0.46%

0%100%

Low · +0.20 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3

OPENSUSE-SU-2026:11394-1 SUSE-SU-2026:3482-1 CGA-Q348-JCX2-VQC9

Timeline

29-07-2026
PublishedVulnerability first disclosed.
29-07-2026
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS metrics

9 scores · 7 sources · 2 versions

v4.08.7v3.17.5

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

+0.20 pp

From 0.26% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected systems

Chainguard200 products

airbyte-server< 2.0.0-r8
airbyte-server-fips< 2.0.0-r10
akhq< 0.27.1-r11
apache-activemq-artemis< 2.55.0-r1
apache-camel-karavan-devmode< 4.18.1-r8

apache-hop< 2.18.1-r9
apache-hop-fips< 2.18.1-r6
apache-nifi< 2.10.0-r5
apache-pulsar-4.0< 4.0.12-r2
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.3-r3
apache-pulsar-fips-4.0< 4.0.12-r2
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-pulsar-fips-4.2< 4.2.3-r2
apicurio-registry< 3.3.0-r10
apicurio-registry-3-operator< 3.3.0-r10
apicurio-registry-3-operator-fips< 3.3.0-r7
apicurio-registry-fips< 3.3.0-r7
camunda-8.8< 8.8.31-r2
camunda-8.9< 8.9.13-r1
camunda-zeebe-8.6< 8.6.39-r6
camunda-zeebe-8.7< 8.7.35-r1
camunda-zeebe-8.8< 8.8.32-r1
camunda-zeebe-8.9< 8.9.13-r1
cassandra-5.0< 5.0.8-r12
cassandra-fips-5.0< 5.0.8-r7
cassandra-reaper< 5.0.0-r2
celeborn-0.5< 0.5.4-r32 | All versions (No fix recorded)
celeborn-0.6< 0.6.3-r13 | All versions (No fix recorded)
celeborn-0.7< 0.7.0-r9 | < 0.7.0-r3
cloudwatch-exporter< 0.18.0-r5 | < 0.18.0-r1
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.22-r0
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
commercial-elasticsearch-9.4< 9.4.8-r0
commercial-elasticsearch-9.5< 9.5.5-r0
conductor< 3.31.0-r5
conductor-fips< 3.31.0-r6
druid< 37.0.0-r56 | < 37.0.0-r44
elasticsearch-8.19< 8.19.19-r1
elasticsearch-8.19-iamguarded< 8.19.19-r1
elasticsearch-8.19-iamguarded-fips< 8.19.19-r1
elasticsearch-9.1< 9.1.10-r8
elasticsearch-9.1-iamguarded< 9.1.10-r8
elasticsearch-9.1-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.2< 9.2.8-r7
elasticsearch-9.2-iamguarded< 9.2.8-r7
elasticsearch-9.2-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.3All versions (No fix recorded)
elasticsearch-9.3-iamguarded< 9.3.8-r6
elasticsearch-9.3-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.4< 9.4.5-r4
elasticsearch-9.4-iamguarded< 9.4.5-r3
elasticsearch-9.4-iamguarded-fips< 9.4.5-r5
elasticsearch-9.5< 9.5.1-r1
elasticsearch-9.5-iamguarded< 9.5.1-r1
elasticsearch-9.5-iamguarded-fips< 9.5.2-r3
elasticsearch-fips-8.19< 8.19.19-r1
elasticsearch-fips-9.1All versions (No fix recorded)
elasticsearch-fips-9.2All versions (No fix recorded)
elasticsearch-fips-9.3All versions (No fix recorded)
elasticsearch-fips-9.4< 9.4.5-r5
elasticsearch-fips-9.5< 9.5.2-r3
floci< 1.5.33-r2
floci-az< 0.9.0-r3
flyway< 13.0.0-r1
flyway-fips< 13.0.0-r2
gremlin-server< 3.8.1-r2
grpc-java-fips-1.56.0-m2< 1.56.0-r7
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r14 | < 3.5.0-r3 | All versions (No fix recorded)
hono-adapter-mqtt< 2.7.0-r28
hono-cli< 2.7.0-r28
hono-service-auth< 2.7.0-r28
hono-service-command-router< 2.7.0-r28
hono-service-device-registry-jdbc< 2.7.0-r28
infinispan-15.0< 15.0.22-r14
infinispan-15.1< 15.1.7-r25
infinispan-15.2< 15.2.6-r23
infinispan-16.0< 16.0.14-r2
infinispan-16.1< 16.1.4-r7
infinispan-16.2< 16.2.1-r2
kafbat-ui< 1.5.0-r10
kafbat-ui-fips< 1.5.0-r6
kafka_exporter-strimzi-compat< 1.2.0-r4 | < 1.2.0-r5
kafka-3.7< 3.7.2-r59
kafka-3.8< 3.8.1-r59
kafka-3.9< 3.9.2-r10
kafka-bridge< 1.0.0-r9
kafka-bridge-fips< 1.0.0-r6
kafka-strimzi-compatAll versions (No fix recorded)
kayenta-2025.2< 2025.2.4-r6
kayenta-2025.4< 2025.4.6-r11
kayenta-2026.0< 2026.0.4-r17
kayenta-2026.1< 2026.1.2-r1
kayenta-fips-2025.2< 2025.2.4-r7
kayenta-fips-2025.4< 2025.4.6-r6
kayenta-fips-2026.0< 2026.0.4-r11
kayenta-fips-2026.1< 2026.1.2-r1
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.5-operatorAll versions (No fix recorded)
keycloak-26.6< 26.6.4-r20
keycloak-26.6-iamguarded-compat< 26.6.4-r20
keycloak-26.6-operator< 26.6.4-r20
keycloak-26.7< 26.7.0-r3
keycloak-26.7-iamguarded-compat< 26.7.0-r3
keycloak-26.7-operator< 26.7.0-r3
keycloak-fips-26.5< 26.5.7-r5
keycloak-fips-26.5-iamguarded-fips< 26.5.7-r5
keycloak-fips-26.5-operator< 26.5.7-r5
keycloak-fips-26.6< 26.6.4-r5
keycloak-fips-26.6-iamguarded-fips< 26.6.4-r5
keycloak-fips-26.6-operator< 26.6.4-r5
keycloak-fips-26.7< 26.7.0-r2
keycloak-fips-26.7-iamguarded-fips< 26.7.0-r2
keycloak-fips-26.7-operator< 26.7.0-r2
knative-kafka-broker-1.20-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-1.20-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-1.21-dispatcher-loom< 1.21.4-r14
knative-kafka-broker-1.21-receiver-loom< 1.21.4-r14
knative-kafka-broker-1.22-dispatcher-loom< 1.22.2-r7
knative-kafka-broker-1.22-receiver-loom< 1.22.2-r7
knative-kafka-broker-fips-1.20-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-fips-1.20-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.4-r9
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.4-r9
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.2-r10
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.2-r10
kserve-modelmesh< 0.12.0-r38
localstack< 4.14.0-r20
logstash-8.19< 8.19.19-r3
logstash-8.19-iamguarded-compat< 8.19.19-r3
logstash-8.19-with-output-opensearch< 8.19.19-r3
logstash-9.2All versions (No fix recorded) | < 9.2.8-r6
logstash-9.2-iamguarded-compatAll versions (No fix recorded) | < 9.2.8-r6
logstash-9.2-with-output-opensearchAll versions (No fix recorded) | < 9.2.8-r6
logstash-9.3All versions (No fix recorded)
logstash-9.3-iamguarded-compatAll versions (No fix recorded)
logstash-9.4< 9.4.4-r3
logstash-9.4-iamguarded-compat< 9.4.4-r3
logstash-9.5< 9.5.0-r1
logstash-9.5-iamguarded-compat< 9.5.0-r1
logstash-fips-9.4< 9.4.4-r1
logstash-fips-9.4-iamguarded-compat< 9.4.4-r1
management-api-for-apache-cassandra-5.0< 0.1.122-r2
metabase< 0.63.2-r3
neo4j-2025.12All versions (No fix recorded)
neo4j-2026.01All versions (No fix recorded)
neo4j-2026.02< 2026.02.3-r4
neo4j-2026.03< 2026.03.1-r4
neo4j-2026.04< 2026.04.0-r3
neo4j-2026.05< 2026.05.0-r12
neo4j-2026.05-docker-publishAll versions (No fix recorded)
neo4j-2026.06< 2026.06.0-r2
neo4j-5.26< 5.26.28-r6
nuxeo-2023< 2023.45-r3
opensearch-2< 2.19.6-r6
opensearch-2-ml-commons< 2.19.6-r6
opensearch-2-performance-analyzer< 2.19.6-r6
opensearch-2-repository-azure< 2.19.6-r6
opensearch-2-repository-s3< 2.19.6-r6
opensearch-2-security< 2.19.6-r6
opensearch-2-transport-nio< 2.19.6-r6
opensearch-3< 3.7.0-r5
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compat< 3.8.0-r3
opensearch-3-ml-commons< 3.7.0-r5
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-notifications< 3.7.0-r5
opensearch-3-repository-azure< 3.7.0-r5
opensearch-3-repository-s3< 3.7.0-r5
opensearch-3-security< 3.7.0-r5
opensearch-3-security-analytics< 3.8.0-r2
opensearch-fips-3< 3.7.0-r5
opensearch-fips-3-ml-commons< 3.7.0-r5
opensearch-fips-3-notifications< 3.7.0-r5
opensearch-fips-3-repository-azure< 3.7.0-r5
opensearch-fips-3-repository-s3< 3.7.0-r5
opensearch-fips-3-security< 3.7.0-r5
opensearch-fips-3-security-analytics< 3.8.0-r2
pinot< 1.5.1-r5
pinot-fips< 1.5.1-r5
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
reposilite< 3.5.28-r7
request-9047-keycloak-fips-26.4< 26.4.7-r22
request-9047-keycloak-fips-26.4-iamguarded-fips< 26.4.7-r22
request-9047-keycloak-fips-26.4-operator< 26.4.7-r22
request-9047-keycloak-fips-26.5< 26.5.7-r14
request-9047-keycloak-fips-26.5-iamguarded-fips< 26.5.7-r14
request-9047-keycloak-fips-26.5-operator< 26.5.7-r14
request-9047-keycloak-fips-26.6< 26.6.4-r6
request-9047-keycloak-fips-26.6-iamguarded-fips< 26.6.4-r6
request-9047-keycloak-fips-26.6-operator< 26.6.4-r6
s3proxy< 3.3.0-r5
s3proxy-fips< 3.3.0-r4

Show all 200

1 vendor · 200 products · Showing 200 of 320. Use Open JSON for the complete list.

References

9 links

github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
ubuntu.com/security/CVE-2026-59901REPORT
www.cve.org/CVERecord?id=CVE-2026-59901REPORT
security-tracker.debian.org/tracker/CVE-2026-59901Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59901.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-59901Advisory
github.com/netty/nettyPACKAGE
github.com/netty/netty/releases/tag/netty-4.1.136.FinalWEB
github.com/netty/netty/releases/tag/netty-4.2.16.FinalWEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities