CVE-2021-37136

7.5 highEPSS 5.9%

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

CVSS 3.1: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 5.9% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-25)
CWE: CWE-400
Published: 2021-10-19
Modified: 2026-10-08
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
netapp:oncommand_insight
netty:netty
oracle:banking_apis
oracle:banking_digital_experience
oracle:coherence
oracle:commerce_guided_search
oracle:communications_brm_-_elastic_charging_engine
oracle:communications_cloud_native_core_binding_support_function
oracle:communications_cloud_native_core_network_slice_selection_function
oracle:communications_cloud_native_core_policy
oracle:communications_cloud_native_core_security_edge_protection_proxy
oracle:communications_cloud_native_core_unified_data_repository
oracle:communications_diameter_signaling_router
oracle:communications_instant_messaging_server
oracle:helidon
oracle:peoplesoft_enterprise_peopletools
oracle:webcenter_portal
quarkus:quarkus

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-grg4-wf29-r9vv	Maven	io.netty:netty-codec	<4.1.68.Final	4.1.68.Final
GHSA-grg4-wf29-r9vv	Maven	org.jboss.netty:netty	all versions	no fix published
GHSA-grg4-wf29-r9vv	Maven	io.netty:netty	all versions	no fix published

References

Check your stack JSON