Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/io.netty/netty-codec-compression@4.2.5.Final
purl pkg:maven/io.netty/netty-codec-compression@4.2.5.Final
Next non-vulnerable version 4.2.16.Final
Latest non-vulnerable version 4.2.16.Final
Risk score 3.9
Vulnerabilities affecting this package (4)
Advisory Summary Fixed in package version
GHSA-mj4r-2hfc-f8p6
Aliases:
CVE-2026-42583
Netty Lz4FrameDecoder is vulnerable to resource exhaustion ### Summary Lz4FrameDecoder allocates a ByteBuf of size `decompressedLength` (up to 32 MB …
4.2.13.Final
Vulnerable
GHSA-558v-64gr-wgg4
Aliases:
CVE-2026-59901
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang The `Bzip2Decoder` handler in Netty's compression codec …
4.2.16.Final
Not vulnerable
CVE-2026-42583
Aliases:
GHSA-mj4r-2hfc-f8p6
Netty Lz4FrameDecoder is vulnerable to resource exhaustion Lz4FrameDecoder allocates a ByteBuf of size `decompressedLength` (up to 32 MB per block) … There are no reported fixed by versions.
CVE-2026-59901
Aliases:
GHSA-558v-64gr-wgg4
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang The `Bzip2Decoder` handler in Netty's compression codec … There are no reported fixed by versions.
Vulnerabilities fixed by this package (1)

Advisory Summary Aliases
GHSA-3p8m-j85q-pgmj
Netty's decoders vulnerable to DoS via zip bomb style attack ### Summary With specially crafted input, `BrotliDecoder` and some other … CVE-2025-58057