CVE-2021-37137CWE-400

CVE-2021-37137: vulnerability in The Netty project Netty

Published · Updated

Follow this CVE+ Monitor netty+ Monitor netty

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 6.6%
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Affected products
The Netty project · Netty
Related CVEs — The Netty project Netty

In the same product, most dangerous first.

CVE-2021-37136—CVE-2021-37136EPSS 5.9%