CyberRota Analysis
AI-GeneratedThe Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack due to a flaw in the run-length encoding state machine, which can be exploited by sending a malformed bzip2 stream, leading to an infinite loop that captures the event-loop thread. This issue affects versions prior to 4.1.136.Final and 4.2.16.Final, and users of Netty should prioritize upgrading to these versions to mitigate the risk of service disruption. Organizations relying on Netty for network applications should assess their deployments and apply the necessary updates promptly.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Related CVEs
Other vulnerabilities affecting the same vendor(s)