Skip to content
OpenAdvisories

Package · Maven

io.netty:netty-codec-compression

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.7
    CVE-2026-59901

    Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stre…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-42583

    Netty: Lz4FrameDecoder resource exhaustion

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus comp…

    netty io.netty netty netty-codec-compression Debian Wolfi Maven
  • Medium 6.9
    CVE-2025-58057

    Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below,…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven