CVE-2021-37137

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

• netty netty (< 4.1.68) • oracle banking apis (>= 18.1 <= 18.3) • oracle banking apis 19.1 • oracle banking apis 19.2 • oracle banking apis 20.1 • oracle banking apis 21.1 • oracle banking digital experience 18.1 • oracle banking digital experience 18.2 • oracle banking digital experience 18.3 • oracle banking digital experience 19.1 • oracle banking digital experience 19.2 • oracle banking digital experience 20.1 • oracle banking digital experience 21.1 • oracle commerce guided search 11.3.2 • oracle communications brm - elastic charging engine (< 12.0.0.4.6) • oracle communications brm - elastic charging engine 12.0.0.5.0 • oracle communications cloud native core binding support function 1.10.0 • oracle communications diameter signaling router (>= 8.0.0.0 <= 8.5.0.2) • oracle peoplesoft enterprise peopletools 8.57 • oracle peoplesoft enterprise peopletools 8.58 • oracle peoplesoft enterprise peopletools 8.59 • oracle webcenter portal 12.2.1.3.0 • oracle webcenter portal 12.2.1.4.0 • quarkus quarkus (< 2.2.4) • netapp oncommand insight • debian debian linux 10.0 • debian debian linux 11.0