CVE-2021-37136
- State
- Published
- Severity
- Not scored
- Published
- Oct 19, 2021
- Updated
- Oct 8, 2026
- Reserved
- Jul 20, 2021
Description
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Scores
The record has no CVSS score.
Weaknesses
Affected Products
| Product | Versions |
|---|---|
NettyThe Netty project |
|
References
- https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv
- [tinkerpop-dev] 20211025 [jira] [Created] (TINKERPOP-2632) Netty 4.1.61 flagged with two high severity security violationsmailing-list
- [druid-commits] 20211025 [GitHub] [druid] jihoonson opened a new pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3mailing-list
- [druid-commits] 20211025 [GitHub] [druid] jihoonson commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3mailing-list
- [druid-commits] 20211025 [GitHub] [druid] a2l007 commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3mailing-list
- [druid-commits] 20211026 [GitHub] [druid] clintropolis merged pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3mailing-list
- [druid-commits] 20211026 [GitHub] [druid] jihoonson commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220210-0012/
- https://www.oracle.com/security-alerts/cpujul2022.html
- [debian-lts-announce] 20230111 [SECURITY] [DLA 3268-1] netty security updatemailing-list
- DSA-5316vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.