An infinite loop vulnerability in the Netty network application framework allows unauthenticated remote attackers to cause a denial of service via resource exhaustion.

The vulnerability is caused by an infinite loop with an unreachable exit condition (CWE-835) within the compression codec logic. An unauthenticated attacker can send specially crafted network traffic to an application using the affected Netty components, leading to high CPU usage and service unavailability.

With a CVSS score of 8.7, this vulnerability poses a severe risk to application availability. Since the attack is network-based and does not require authentication, it is highly automatable, making it an attractive target for attackers looking to disrupt critical services relying on the Netty framework.

Immediate Action: Update the affected Maven dependencies to io.netty:netty-codec-compression version 4.2.16.Final and io.netty:netty-codec version 4.1.136.Final.

Proactive Monitoring: Monitor application CPU utilization and network traffic patterns for sudden, sustained spikes that may indicate an attempt to trigger the infinite loop.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System with signatures capable of identifying or blocking malformed compression payloads.

Public Exploit Available: Unknown

Given the ease of exploitation and the critical nature of the Netty framework in modern Java applications, all organizations should audit their dependency trees and update to the patched versions immediately. Failure to patch may leave public-facing services vulnerable to trivial denial-of-service attacks.