{
  "cveId": "CVE-2021-37136",
  "url": "https://patchblox.com/security/cve/CVE-2021-37136",
  "summary": "CVE-2021-37136 is fixed in 3 products on 1 platform, first by RLSA-2022:8506, released November 16, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libnetty-java: The Bzip2 decompression decoder function doesn\u0027t allow setting sizerestrictions on the decompressed output data (whic...",
  "description": "The Bzip2 decompression decoder function doesn\u0027t allow setting sizerestrictions on the decompressed output data (which affects the allocationsize used during decompression). All users of Bzip2Decoder are affected.The malicious input can trigger an OOME and so a DoS attack",
  "published": "2021-10-19T08:15:00Z",
  "severity": "Medium",
  "epss": 0.05908,
  "epssPercentile": 0.93276,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libdb",
      "release": "rocky 8",
      "fixedVersion": "0:5.3.28-42.el8_4",
      "fix": "RLSA-2022:8506",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2022-8506",
      "released": "2022-11-16T13:21:30Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:4.1.7-4ubuntu0.1\u002Besm2",
      "fix": "libnetty-java 1:4.1.7-4ubuntu0.1\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libnetty-java-1-4.1.7-4ubuntu0.1-esm2",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:4.1.45-1ubuntu0.1~esm1",
      "fix": "libnetty-java 1:4.1.45-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libnetty-java-1-4.1.45-1ubuntu0.1-esm1",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:4.1.48-4\u002Bdeb11u1build0.22.04.1",
      "fix": "libnetty-java 1:4.1.48-4\u002Bdeb11u1build0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libnetty-java-1-4.1.48-4-deb11u1build0.22.04.1",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "4.1.48-6",
      "fix": "libnetty-java 4.1.48-6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libnetty-java-4.1.48-6",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "4.1.48-6",
      "fix": "libnetty-java 4.1.48-6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libnetty-java-4.1.48-6",
      "released": "2026-01-16T01:42:24Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "1:4.1.48-4\u002Bdeb11u1",
      "fix": "DSA-5316-1",
      "url": "https://patchblox.com/security/fix/linux/dsa-5316-1",
      "released": "2023-01-11T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}