PT-2021-7931 · Unknown+5 · Bzip2Decoder+5

Published 2021-09-09 · Updated 2026-04-01 · CVE-2021-37136

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Bzip2Decoder (affected versions not specified)

Description The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data, which affects the allocation size used during decompression. All users of Bzip2Decoder are affected. The malicious input can trigger an OutOfMemoryError (OOME) and thus a Denial of Service (DoS) attack.

Recommendations As a temporary workaround, consider not using the Bzip2Decoder until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2023-05622

CLEANSTART-2026-CI66802

CVE-2021-37136

DLA-3268-1

DSA-5316-1

GHSA-GRG4-WF29-R9VV

OESA-2021-1423

OPENSUSE-SU-2022_1271-1

OPENSUSE-SU-2024:14442-1

RHSA-2022:4918

RHSA-2022:4919

RHSA-2022:8506

RHSA-2025:9582

RHSA-2025:9583

RLSA-2022:8506

SUSE-SU-2022:1271-1

SUSE-SU-2022:3617-1

SUSE-SU-2022:3760-1

SUSE-SU-2022:3793-1

USN-6049-1

Affected Products

Astra Linux

Bzip2Decoder

Linuxmint

Rocky Linux

Suse

Ubuntu

References · 430

• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-12798 · Security Note
• https://osv.dev/vulnerability/GHSA-grg4-wf29-r9vv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6923 · Security Note
• https://osv.dev/vulnerability/DSA-5316-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37136 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-37136 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://osv.dev/vulnerability/OESA-2021-1423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1225 · Security Note
• https://ubuntu.com/security/CVE-2021-43797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12254 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:3793-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37136 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-0938 · Security Note