What’s Vulnerable › Vulnerabilities
CVE-2021-37136
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-10-19 · updated 2026-10-08
- Weakness: CWE-400
Description
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Affected products
- Debian Linux: 10.0, 11.0
- OnCommand Insight: all versions
- netty: before 4.1.68 — fixed in 4.1.68
- Oracle Banking Apis: from 18.1 through 18.3; 19.1, 19.2, 20.1, 21.1
- Oracle Corporation Banking Digital Experience: 18.1, 18.2, 18.3, 19.1, 19.2, 20.1 (+1)
- Oracle Corporation Oracle Coherence: 12.2.1.4.0, 14.1.1.0.0
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Corporation Communications BRM - Elastic Charging Engine: before 12.0.0.4.6; 12-0.0.5.0 — fixed in 12.0.0.4.6
- Oracle Communications Cloud Native Core Binding Support Function: 1.10.0, 1.11.0
- Oracle Communications Cloud Native Core Network Slice Selection Function: 1.8.0
- Oracle Communications Cloud Native Core Policy: 1.15.0
- Oracle Communications Cloud Native Core Security Edge Protection Proxy: 1.7.0
- Oracle Communications Cloud Native Core Unified Data Repository: 1.15.0
- Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0.0 through 8.5.0.2
- Oracle Communications Instant Messaging Server: 8.1
- Oracle Corporation Helidon: 1.4.10, 2.4.0
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.48, 8.57, 8.58, 8.59
- Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
- quarkusio quarkus: before 2.2.4 — fixed in 2.2.4
How to fix
Upgrade to a fixed version: netty 4.1.68; Oracle Corporation Communications BRM - Elastic Charging Engine 12.0.0.4.6; quarkusio quarkus 2.2.4. Check the vendor advisory for mitigations.
References
- https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv
- https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3Cdev.tinkerpop.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
- https://security.netapp.com/advisory/ntap-20220210-0012/
- https://www.debian.org/security/2023/dsa-5316
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
Get alerted when CVE-2021-37136 or the next vulnerability affects your stack