HIGH
GHSA-558v-64gr-wgg4
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
Quick fix
GHSA-558v-64gr-wgg4 — io.netty:netty-codec-compression: upgrade to the fixed version with the command below.
# pom.xml: bump <version>4.2.16.Final</version> for io.netty:netty-codec-compressionDetails
The `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / io.netty:netty-codec-compression
Introduced in:
4.2.0.Final Fixed in: 4.2.16.Final Fix
# pom.xml: bump <version>4.2.16.Final</version> for io.netty:netty-codec-compression Maven / io.netty:netty-codec
Introduced in:
0 Fixed in: 4.1.136.Final Fix
# pom.xml: bump <version>4.1.136.Final</version> for io.netty:netty-codec