CVE-2021-37137

HIGH

Netty < 4.1.68 - Uncontrolled Resource Consumption via Snappy Frame Decoder

Title source: llm
STIX 2.1

Description

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

References (13)

Core 13
Core References
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
Third Party Advisory vendor-advisory
https://www.debian.org/security/2023/dsa-5316

Scores

CVSS v3 7.5
EPSS 0.0238
EPSS Percentile 85.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-400
Status published
Products (30)
debian/debian_linux 10.0
debian/debian_linux 11.0
io.netty/netty 0Maven
io.netty/netty-codec 4.0.0 - 4.1.68.FinalMaven
netapp/oncommand_insight
netty/netty < 4.1.68
oracle/banking_apis 19.1
oracle/banking_apis 19.2
oracle/banking_apis 20.1
oracle/banking_apis 21.1
... and 20 more
Published Oct 19, 2021
Tracked Since Feb 18, 2026