Yüksek CVSS 7.5

CVE-2021-37137: Netty: denetimsiz kaynak tüketimi

Yayın: 19 Ekim 2021 18:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

Özet bilgiler

Ürün: Netty Netty
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: %6,57 (yüzdelik 94)
CWE: CWE-400
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
netty-netty	—	—	4.1.68
oracle-banking-apis	18.1	18.3	—
oracle-banking-apis	19.1	19.1	—
oracle-banking-apis	19.2	19.2	—
oracle-banking-apis	20.1	20.1	—
oracle-banking-apis	21.1	21.1	—
oracle-banking-digital-experience	18.1	18.1	—
oracle-banking-digital-experience	18.2	18.2	—
oracle-banking-digital-experience	18.3	18.3	—
oracle-banking-digital-experience	19.1	19.1	—
oracle-banking-digital-experience	19.2	19.2	—
oracle-banking-digital-experience	20.1	20.1	—
oracle-banking-digital-experience	21.1	21.1	—
oracle-commerce-guided-search	11.3.2	11.3.2	—
oracle-communications-brm-elastic-charging-engine	—	—	12.0.0.4.6
oracle-communications-brm-elastic-charging-engine	12.0.0.5.0	12.0.0.5.0	—
oracle-communications-cloud-native-core-binding-support-function	1.10.0	1.10.0	—
oracle-communications-diameter-signaling-router	8.0.0.0	8.5.0.2	—
oracle-peoplesoft-enterprise-peopletools	8.57	8.57	—
oracle-peoplesoft-enterprise-peopletools	8.58	8.58	—
oracle-peoplesoft-enterprise-peopletools	8.59	8.59	—
oracle-webcenter-portal	12.2.1.3.0	12.2.1.3.0	—
oracle-webcenter-portal	12.2.1.4.0	12.2.1.4.0	—
quarkus-quarkus	—	—	2.2.4
netapp-oncommand-insight	—	—	—
debian-debian-linux	10.0	10.0	—
debian-debian-linux	11.0	11.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları