CVE-2026-59901¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Netty's Bzip2Decoder handler in the compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The defect lives in the run-length encoding state machine within Bzip2BlockDecompressor.read(). Fixed in 4.1.136.Final and 4.2.16.Final.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
A single Netty distribution reaches the runtime in WSO2 Identity Server, shipped as a WSO2 orbit bundle that re-wraps an upstream release within the affected range. The vulnerable class is therefore physically present, and this finding turns entirely on whether it is reachable.
The bzip2 decoder is never used. Nothing in the shipped distribution references io.netty.handler.codec.compression.Bzip2Decoder or Bzip2BlockDecompressor; these classes appear only inside the Netty bundle itself. A Netty pipeline containing Bzip2Decoder fed an attacker-supplied bzip2 stream does not exist in this product.
No Netty HTTP server is ever started. io.netty.handler.codec.http.HttpServerCodec and io.netty.handler.codec.spdy.SpdyFrameCodec are referenced by nothing in the shipped distribution, so no Netty server pipeline is ever built. WSO2 Identity Server serves all inbound HTTP through embedded Apache Tomcat, configured in repository/conf/tomcat/catalina-server.xml.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.