7.5
CVSSv3

CVE-2021-37137

Published: 19/10/2021 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

netty netty

oracle webcenter portal 12.2.1.3.0

oracle peoplesoft enterprise peopletools 8.57

oracle banking digital experience 18.2

oracle banking digital experience 18.3

oracle banking digital experience 19.1

oracle banking digital experience 18.1

oracle peoplesoft enterprise peopletools 8.58

oracle webcenter portal 12.2.1.4.0

oracle banking digital experience 19.2

oracle banking digital experience 20.1

oracle commerce guided search 11.3.2

oracle peoplesoft enterprise peopletools 8.59

oracle banking digital experience 21.1

oracle banking apis

oracle banking apis 19.1

oracle banking apis 19.2

oracle banking apis 20.1

oracle banking apis 21.1

oracle communications cloud native core binding support function 1.10.0

oracle communications diameter signaling router

oracle communications brm - elastic charging engine 12.0.0.5.0

oracle communications brm - elastic charging engine

quarkus quarkus

netapp oncommand insight -

debian debian linux 10.0

debian debian linux 11.0

Vendor Advisories

Debian Bug report logs - #1014769 netty: CVE-2021-37136 CVE-2021-37137 Package: src:netty; Maintainer for src:netty is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Moritz Mühlenhoff <jmm@inutilorg> Date: Mon, 11 Jul 2022 18:24:01 UTC Severity: important Tags: security, upstre ...
Several out-of-memory, stack overflow or HTTP request smuggling vulnerabilities have been discovered in Netty, a Java NIO client/server socket framework, which may allow attackers to cause a denial of service or bypass restrictions when used as a proxy For the stable distribution (bullseye), these problems have been fixed in version 1:4148-4+deb ...
Synopsis Moderate: Red Hat build of Quarkus 225 release and security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat build of QuarkusRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a det ...
Synopsis Moderate: Red Hat JBoss Enterprise Application Platform 745 security update Type/Severity Security Advisory: Moderate Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 74Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring S ...
Synopsis Moderate: Red Hat JBoss Enterprise Application Platform 745 security update on RHEL 8 Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Application P ...
Synopsis Moderate: Red Hat JBoss Enterprise Application Platform 745 security update on RHEL 7 Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Application P ...
Synopsis Moderate: Red Hat Integration Camel Extensions for Quarkus 221 security update Type/Severity Security Advisory: Moderate Topic A security update to Red Hat Integration Camel Extensions for Quarkus 22 is now available The purpose of this text-only errata is to inform you about the security issues fixedRed Hat Product Security has ...
Synopsis Moderate: Red Hat Process Automation Manager 7130 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat Process Automation ManagerRed Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base score, which gives a ...
Synopsis Moderate: Red Hat OpenShift Logging Security and Bug update Release 537 Type/Severity Security Advisory: Moderate Topic Openshift Logging Bug Fix Release (537)Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed seve ...
Synopsis Moderate: Red Hat OpenShift Logging Security and Bug update Release 541 Type/Severity Security Advisory: Moderate Topic Logging Subsystem 541 - Red Hat OpenShiftRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed se ...
Synopsis Moderate: Openshift Logging Security and Bug update Release (5210) Type/Severity Security Advisory: Moderate Topic Openshift Logging Bug Fix Release (5210)Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity ...
Synopsis Important: Service Registry (container images) release and security update [230GA] Type/Severity Security Advisory: Important Topic An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog The purpose of this text-only errata is to inform you about the security issues fi ...
Synopsis Important: Satellite 612 Release Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat Satellite 612 The release contains a new version of Satellite and important security fixe ...
概述 Important: Red Hat AMQ Streams 240 release and security update 类型/严重性 Security Advisory: Important 标题 Red Hat AMQ Streams 240 is now available from the Red Hat Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base scor ...
Synopsis Moderate: Red Hat Data Grid 830 security update Type/Severity Security Advisory: Moderate Topic An update for Red Hat Data Grid is now availableRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is ...
Multiple vulnerabilities have been found in Hitachi Ops Center Common Services CVE-2019-10172, CVE-2020-27218, CVE-2021-4133, CVE-2021-22060, CVE-2021-22096, CVE-2021-30468, CVE-2021-37136, CVE-2021-37137, CVE-2021-37714, CVE-2021-40690, CVE-2021-42575, CVE-2022-22968 Affected products and versions are listed below Please upgrade your version ...