Fiche vulnérabilité

CVE-2021-37137 : faille élevée netty netty (CVSS 7.5)

Description

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

En bref

Sévérité: Élevée (CVSS 7.5)
Vecteur CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitation active: Non signalée par la CISA
Publication: 19 oct. 2021
Dernière mise à jour: 17 juin 2026

Produits concernés

netty netty
oracle banking apis
oracle banking digital experience
oracle commerce guided search
oracle communications brm - elastic charging engine
oracle communications cloud native core binding support function
oracle communications diameter signaling router
oracle peoplesoft enterprise peopletools
oracle webcenter portal
quarkus quarkus
netapp oncommand insight
debian debian linux

Références

Rechercher une autre vulnérabilité dans la base CVE