io.netty netty-codec-compression vulnerabilities

Latest io.netty netty-codec-compression CVEs

Newest publication first

1. CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

   Published 2026-07-29

   High·CVSS 8.7 EPSS 0.46%

   Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently cap...

2. CVE-2026-42583 Netty: Lz4FrameDecoder resource exhaustion

   Published 2026-05-13

   High·CVSS 7.5 EPSS 0.46%

   Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload...

3. CVE-2025-58057 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

   Published 2025-09-03

   Medium·CVSS 6.9 EPSS 0.63%

   Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.