High severity · published Oct 19, 2021
CVE-2021-37137
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage
7.5
CVSS
6.6%
EPSS
No
On KEV
Description
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.6% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netty · The Netty project
before 4.1.68Final · source: vendor, NVD
BA
Banking Apis · Oracle
18.1 through 18.3; 19.1; 19.2; 20.1; 21.1 · source: NVD
BD
Banking Digital Experience · Oracle
18.1; 18.2; 18.3; 19.1; 19.2; 20.1; +1 more · source: NVD
CG
CB
Communications Brm - Elastic Charging Engine · Oracle
before 12.0.0.4.6; 12.0.0.5.0 · source: NVD
CD
Communications Diameter Signaling Router · Oracle
8.0.0.0 through 8.5.0.2 · source: NVD
DL
Debian Linux · Debian
10.0; 11.0 · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
PE
Peoplesoft Enterprise Peopletools · Oracle
8.57; 8.58; 8.59 · source: NVD
QU
Quarkus · Quarkus
before 2.2.4 · source: NVD
WP
Webcenter Portal · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD