What’s Vulnerable › Vulnerabilities
CVE-2021-37137
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 6.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-10-19 · updated 2026-10-08
- Weakness: CWE-400
Description
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Affected products
- Debian Linux: 10.0, 11.0
- OnCommand Insight: all versions
- netty: before 4.1.68 — fixed in 4.1.68
- Oracle Banking Apis: from 18.1 through 18.3; 19.1, 19.2, 20.1, 21.1
- Oracle Corporation Banking Digital Experience: 18.1, 18.2, 18.3, 19.1, 19.2, 20.1 (+1)
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Corporation Communications BRM - Elastic Charging Engine: before 12.0.0.4.6; 12.0.0.5.0 — fixed in 12.0.0.4.6
- Oracle Communications Cloud Native Core Binding Support Function: 1.10.0
- Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0.0 through 8.5.0.2
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.57, 8.58, 8.59
- Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
- quarkusio quarkus: before 2.2.4 — fixed in 2.2.4
How to fix
Upgrade to a fixed version: netty 4.1.68; Oracle Corporation Communications BRM - Elastic Charging Engine 12.0.0.4.6; quarkusio quarkus 2.2.4. Check the vendor advisory for mitigations.
References
- https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363
- https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3Cdev.tinkerpop.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
- https://security.netapp.com/advisory/ntap-20220210-0012/
- https://www.debian.org/security/2023/dsa-5316
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
Get alerted when CVE-2021-37137 or the next vulnerability affects your stack