Homepage

Loop with Unreachable Exit Condition ('Infinite Loop') Affecting elasticsearch-9.3 package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-ELASTICSEARCH93-18281597
  • published24 Jul 2026
  • disclosed29 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 24 Jul 2026

NewCVE-2026-59901  (opens in a new tab)
CWE-835  (opens in a new tab)

How to fix?

There is no fixed version for Minimos:latest elasticsearch-9.3.

NVD Description

Note: Versions mentioned in the description apply only to the upstream elasticsearch-9.3 package and not the elasticsearch-9.3 package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [Bzip2BlockDecompressor.read()]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.