Homepage

Loop with Unreachable Exit Condition ('Infinite Loop') Affecting logstash-input-http package, versions <4.1.12-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-LOGSTASHINPUTHTTP-18301122
  • published25 Jul 2026
  • disclosed29 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 25 Jul 2026

NewCVE-2026-59901  (opens in a new tab)
CWE-835  (opens in a new tab)

How to fix?

Upgrade Minimos:latest logstash-input-http to version 4.1.12-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream logstash-input-http package and not the logstash-input-http package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [Bzip2BlockDecompressor.read()]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.