CVE-2021-37136

27

FAUCET Score

CVE-2021-37136 is a high-severity vulnerability (CVSS 7.5) in the Bzip2 decompression decoder function, affecting products like Debian, NetApp, Netty, Oracle, and Quarkus. It allows an unauthenticated attacker to trigger an Out-of-Memory Error (OOME) and a Denial-of-Service (DoS) attack by providing malicious input that lacks size restrictions on decompressed data. While no active exploitation, public exploit code, or significant community discussion has been observed, the vulnerability remains a potential risk due to its ease of exploitation and high impact.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 4.1.68CPE matchmatch criteria	cpe:2.3:a:netty:netty::::::::
		< 2.2.4CPE matchmatch criteria	cpe:2.3:a:quarkus:quarkus::::::::
		>= 18.1, <= 18.3CPE matchmatch criteria	cpe:2.3:a:oracle:banking_apis::::::::
		19.1CPE matchmatch criteria	cpe:2.3:a:oracle:banking_apis:19.1:::::::*
		19.2CPE matchmatch criteria	cpe:2.3:a:oracle:banking_apis:19.2:::::::*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

5.65%

Probability of exploitation in next 30 days

EPSS Percentile

92.2%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0565 is in the 86th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (53)

mavenpatch availablevia ghsa

Product: io.netty:netty-codecFixed in: 4.1.68.Final

nodejspatch availablevia llm_extracted

Fixed in: 25.4.0

oraclepatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: OpenShift Logging 5.2Fixed in: openshift-logging/elasticsearch6-rhel8:v6.8.1-66

redhatpatch availablevia redhat_api

Product: OpenShift Logging 5.2Fixed in: openshift-logging/elasticsearch6-rhel8:v6.8.1-157

redhatpatch availablevia redhat_api

Product: OpenShift Logging 5.3Fixed in: openshift-logging/elasticsearch6-rhel8:v6.8.1-65

redhatpatch availablevia redhat_api

Product: OpenShift Logging 5.3Fixed in: openshift-logging/elasticsearch6-rhel8:v6.8.1-159

redhatpatch availablevia redhat_api

Product: Red Hat AMQ 7.9.1Fixed in: netty-codec

redhatpatch availablevia redhat_api

Product: Red Hat AMQ Streams 2.0.0Fixed in: netty-codec

redhatpatch availablevia redhat_api

Product: Red Hat AMQ Streams 2.4.0

redhatpatch availablevia redhat_api

Product: Red Hat AMQ Streams 2.5.0

redhatpatch availablevia redhat_api

Product: Red Hat build of Quarkus 2.2.5Fixed in: netty-codec

redhatpatch availablevia redhat_api

Product: Red Hat Data Grid 8.3.0Fixed in: netty-codec

redhatpatch availablevia redhat_api

Product: Red Hat Fuse 7.10Fixed in: netty-codec

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7Fixed in: netty-all

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-glassfish-el-0:3.0.1-4.b08_redhat_00005.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-hibernate-0:5.1.17-3.Final_redhat_00004.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jackson-databind-0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jboss-ejb-client-0:4.0.12-1.Final_redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-netty-0:4.1.63-2.Final_redhat_00003.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-undertow-0:1.4.18-16.SP14_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.1.11-4.GA_redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-wildfly-elytron-0:1.1.14-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-wildfly-http-client-0:1.0.21-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-wildfly-naming-client-0:1.0.13-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-wildfly-openssl-0:1.0.12-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-wildfly-openssl-linux-0:1.0.12-6.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jackson-annotations-0:2.10.4-3.redhat_00006.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jackson-core-0:2.10.4-3.redhat_00006.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jackson-databind-0:2.10.4-5.redhat_00006.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jackson-jaxrs-providers-0:2.10.4-3.redhat_00006.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jackson-modules-base-0:2.10.4-5.redhat_00006.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jackson-modules-java8-0:2.10.4-2.redhat_00006.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-server-migration-0:1.7.2-16.Final_redhat_00017.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-netty-0:4.1.63-5.Final_redhat_00003.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-undertow-0:2.0.41-4.SP5_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.3.14-3.GA_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-wildfly-elytron-0:1.10.17-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-netty-0:4.1.72-4.Final_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.12 for RHEL 8Fixed in: candlepin-0:4.1.15-1.el8sat

redhatpatch availablevia redhat_api

Product: RHINT Camel-Q 2.2.1

redhatpatch availablevia redhat_api

Product: RHINT Service Registry 2.3.0 GAFixed in: netty-codec

redhatpatch availablevia redhat_api

Product: RHPAM 7.13.0 asyncFixed in: netty-codec

redhatpatch availablevia redhat_api

Product: Vert.x 4.1.5Fixed in: netty-codec

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-netty-0:4.1.72-4.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Logging subsystem for Red Hat OpenShift 5.4Fixed in: openshift-logging/elasticsearch6-rhel8:v6.8.1-156

redhatpatch availablevia redhat_api

Product: OpenShift Logging 5.1Fixed in: openshift-logging/elasticsearch6-rhel8:v6.8.1-67

redhatno patchvia redhat_api

Product: Red Hat build of QuarkusFixed in: netty-codec

redhatno patchvia redhat_api

Product: Red Hat Integration Camel K 1Fixed in: netty-codec

redhatno patchvia redhat_api

Product: Red Hat Integration Camel Quarkus 1Fixed in: netty-codec

redhatno patchvia redhat_api

Product: Red Hat Single Sign-On 7Fixed in: netty-codec

redhatno patchvia redhat_api

Product: A-MQ Clients 2Fixed in: netty-codec

redhatend of lifevia redhat_api

Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-metering-hadoop

Vendor Advisories (3)

nodejsllm-nodejs-9e1762a1939f642dCRITICAL

Third-Party Package Updates in Splunk AppDynamics On-Premises Enterprise Console - August 2025

mavenGHSA-grg4-wf29-r9vvhigh

Bzip2Decoder doesn't allow setting size restrictions for decompressed data

redhatCVE-2021-37136Moderate

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

References

github.com / netty/netty/security/advisories/GHSA-grg4-wf29-r9vv

Third Party Advisory

lists.apache.org / thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3Ccommits.druid.apache.org%3E

lists.apache.org / thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3Ccommits.druid.apache.org%3E

lists.apache.org / thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3Ccommits.druid.apache.org%3E

lists.apache.org / thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3E

lists.apache.org / thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3Ccommits.druid.apache.org%3E

lists.apache.org / thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3Cdev.tinkerpop.apache.org%3E

lists.debian.org / debian-lts-announce/2023/01/msg00008.html

Mailing ListThird Party Advisory

security.netapp.com / advisory/ntap-20220210-0012

Third Party Advisory

debian.org / security/2023/dsa-5316

Third Party Advisory

oracle.com / security-alerts/cpuapr2022.html

PatchThird Party Advisory

oracle.com / security-alerts/cpujan2022.html

PatchThird Party Advisory

oracle.com / security-alerts/cpujul2022.html

PatchThird Party Advisory