From 1ed43063d1931d33e56d6ec2ed09185651fa6948 Mon Sep 17 00:00:00 2001
From: pkgagent <pkgagent@tencent.com>
Date: Tue, 25 Aug 2026 15:34:09 +0800
Subject: [PATCH] Fix CVE-2026-59901: upgrade netty to 4.1.136.Final to fix
 Bzip2Decoder infinite loop DoS

---
 kafka-3.9.1-CVE-2026-59901.patch | 30 ++++++++++++++++++++++++++++++
 kafka.spec                       |  7 ++++++-
 sources                          |  2 +-
 3 files changed, 37 insertions(+), 2 deletions(-)
 create mode 100644 kafka-3.9.1-CVE-2026-59901.patch

diff --git a/kafka-3.9.1-CVE-2026-59901.patch b/kafka-3.9.1-CVE-2026-59901.patch
new file mode 100644
index 0000000..1de720f
--- /dev/null
+++ b/kafka-3.9.1-CVE-2026-59901.patch
@@ -0,0 +1,30 @@
+From bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 Mon Sep 17 00:00:00 2001
+From: PkgAgent Robot <pkgagent@opencloudos.tech>
+Date: Tue, 25 Aug 2026 00:00:00 +0800
+Subject: [PATCH] bugfix: upgrade netty to 4.1.136.Final to fix CVE-2026-59901
+
+CVE-2026-59901: Netty Bzip2Decoder is vulnerable to a denial-of-service
+via a malformed bzip2 stream that drives the RLE state machine in
+Bzip2BlockDecompressor.read() into an infinite loop. Fixed upstream in
+netty 4.1.136.Final (commit bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6).
+Bump the bundled netty dependency from 4.1.135.Final to 4.1.136.Final.
+
+---
+ gradle/dependencies.gradle | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
+index a5b5a6c..6c723c1 100644
+--- a/gradle/dependencies.gradle
++++ b/gradle/dependencies.gradle
+@@ -141,7 +141,7 @@ versions += [
+   lz4: "1.8.0",
+   mavenArtifact: "3.9.6",
+   metrics: "2.2.0",
+-  netty: "4.1.135.Final",
++  netty: "4.1.136.Final",
+   opentelemetryProto: "1.0.0-alpha",
+   protobuf: "3.25.5", // a dependency of opentelemetryProto
+   pcollections: "4.0.1",
+--
+2.41.1
diff --git a/kafka.spec b/kafka.spec
index f81cdbd..da417cb 100644
--- a/kafka.spec
+++ b/kafka.spec
@@ -5,7 +5,7 @@
 Summary:        A Distributed Streaming Platform.
 Name:           kafka
 Version:        3.9.1
-Release:        2%{?dist}
+Release:        3%{?dist}
 License:        Apache-2.0
 URL:            http://kafka.apache.org/
 Source0:        https://archive.apache.org/dist/%{name}/%{version}/%{name}-%{version}-src.tgz
@@ -18,6 +18,7 @@ Source1:        gradle-wrapper.jar
 Source2:        gradle.tar.gz
 
 Patch5001:      0001-bugfix-upgrade-netty-to-4.1.135.Final.patch
+Patch0001:      kafka-3.9.1-CVE-2026-59901.patch
 
 BuildRequires: java-devel
 Requires: java-openjdk
@@ -60,6 +61,10 @@ exit 0
 %doc LICENSE
 
 %changelog
+* Tue Aug 25 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 3.9.1-3
+- [Type] security
+- [DESC] Fix CVE-2026-59901: upgrade netty to 4.1.136.Final to fix Bzip2Decoder infinite loop DoS
+
 * Mon Jun 15 2026 licunlong <cunlongli@tencent.com> - 3.9.1-2
 - [Type] security
 - [DESC] upgrade netty to 4.1.135.Final to fix CVE-2026-50010
diff --git a/sources b/sources
index f26d2ec..2a25c5d 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (kafka-3.9.1-src.tgz) = 28b3066cb554e573428ef69d366cd344b0e7114a560eb57b2d3dda0507d266e6e804389457e8788f27b9c8f1dab027698a448bd82ca1d38b788e2874683e8019
 SHA512 (gradle-wrapper.jar) = 61e39dc86eee7292ed018aaf06cd1dd0ea5d3fd3a6b7896550436191424859d98898e0e9746da0dd1d2d7e7fad299373ccba641f868546f482573c53f57306a7
-SHA512 (gradle.tar.gz) = 2e78c399472d30abcf2ee1ba41d35309523db81b22e259852c530e912a73dc9989d1858461dbbcff052d5dd4fd5fa4d7dedbbc655ab1f978744021b4be79996a
+SHA512 (gradle.tar.gz) = a7c39e75d1d86e0c32dd961ee16031466803d608a11ad598969c4ccbd556ba5f47babf0f022296edd88b87e3961159f2501b14e3d646f66c5980e9caaede8565
-- 
Gitee