PT-2021-7976 · Netty+5 · Netty+5
Published
2021-09-09
·
Updated
2024-10-30
·
CVE-2021-37137
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Netty versions prior to 4.1.67.Final
Description
The Snappy frame decoder function does not restrict the chunk length, which may lead to excessive memory usage. Additionally, it may buffer reserved skippable chunks until the whole chunk is received, resulting in excessive memory usage. This issue can be triggered by supplying malicious input that decompresses to a very big size or by sending a huge skippable chunk. All users of SnappyFrameDecoder are affected, putting the application at risk for a denial-of-service attack due to excessive memory usage.
Recommendations
For Netty versions prior to 4.1.67.Final, update to version 4.1.67.Final or later to resolve the issue. As a temporary workaround, consider restricting the input size to prevent excessive memory usage. Additionally, monitor the application's memory usage to detect potential denial-of-service attacks.
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Netty
Rocky Linux
Suse
Ubuntu