Vulnerability in netty

[ Description ]Official description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4090

  Oracle Communications: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-101763CVE-2026-58389CVE-2026-56740+85 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4083

  Oracle Retail Applications: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-34481CVE-2026-41855CVE-2026-59901+1 more CVEs

[ References ]References

• github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4x_refsource_CONFIRM