{
  "cveId": "CVE-2021-37137",
  "url": "https://patchblox.com/security/cve/CVE-2021-37137",
  "summary": "CVE-2021-37137 is fixed in 2 products on 1 platform, first by RLSA-2022:8506, released November 16, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libnetty-java: The Snappy frame decoder function doesn\u0027t restrict the chunk length whichmay lead to excessive memory usage",
  "description": "The Snappy frame decoder function doesn\u0027t restrict the chunk length whichmay lead to excessive memory usage. Beside this it also may buffer reservedskippable chunks until the whole chunk was received which may lead toexcessive memory usage as well. This vulnerability can be triggered bysupplying malicious input that decompresses to a very big size (via anetwork stream or a file) or by sending a huge skippable chunk.",
  "published": "2021-10-19T08:15:00Z",
  "severity": "Medium",
  "epss": 0.06565,
  "epssPercentile": 0.93863,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libdb",
      "release": "rocky 8",
      "fixedVersion": "0:5.3.28-42.el8_4",
      "fix": "RLSA-2022:8506",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2022-8506",
      "released": "2022-11-16T13:21:30Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:4.1.7-4ubuntu0.1\u002Besm2",
      "fix": "libnetty-java 1:4.1.7-4ubuntu0.1\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libnetty-java-1-4.1.7-4ubuntu0.1-esm2",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:4.1.45-1ubuntu0.1~esm1",
      "fix": "libnetty-java 1:4.1.45-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libnetty-java-1-4.1.45-1ubuntu0.1-esm1",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:4.1.48-4\u002Bdeb11u1build0.22.04.1",
      "fix": "libnetty-java 1:4.1.48-4\u002Bdeb11u1build0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libnetty-java-1-4.1.48-4-deb11u1build0.22.04.1",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "4.1.48-6",
      "fix": "libnetty-java 4.1.48-6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libnetty-java-4.1.48-6",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "4.1.48-6",
      "fix": "libnetty-java 4.1.48-6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libnetty-java-4.1.48-6",
      "released": "2026-01-16T01:42:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}