CVE-2021-37136

netty, quarkus, oracle banking apis +16 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-37136

Katalog CVE

CVSS 7.5 · High EPSS 5,9%

Kerentanan Uncontrolled Resource Consumption pada netty, quarkus +17 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

Rincian

Terbit di NVD
19 Oktober 2021
Terakhir diubah
8 Oktober 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-400: Uncontrolled Resource Consumption
EPSS (30 hari)
5,9% peluang dieksploitasi; lebih tinggi dari 93,0% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
netty netty Semua versi sebelum 4.1.68
quarkus quarkus Semua versi sebelum 2.2.4
oracle banking apis Versi 18.1 hingga 18.3
oracle banking apis Versi 19.1
oracle banking apis Versi 19.2
oracle banking apis Versi 20.1
oracle banking apis Versi 21.1
oracle banking digital experience Versi 18.1
oracle banking digital experience Versi 18.2
oracle banking digital experience Versi 18.3
oracle banking digital experience Versi 19.1
oracle banking digital experience Versi 19.2
oracle banking digital experience Versi 20.1
oracle banking digital experience Versi 21.1
oracle coherence Versi 12.2.1.4.0
oracle coherence Versi 14.1.1.0.0
oracle commerce guided search Versi 11.3.2
oracle communications brm - elastic charging engine Semua versi sebelum 12.0.0.4.6
oracle communications brm - elastic charging engine Versi 12 0.0.5.0
oracle communications cloud native core binding support function Versi 1.10.0
oracle communications cloud native core binding support function Versi 1.11.0
oracle communications cloud native core network slice selection function Versi 1.8.0
oracle communications cloud native core policy Versi 1.15.0
oracle communications cloud native core security edge protection proxy Versi 1.7.0
oracle communications cloud native core unified data repository Versi 1.15.0
oracle communications diameter signaling router Versi 8.0.0.0 hingga 8.5.0.2
oracle communications instant messaging server Versi 8.1
oracle helidon Versi 1.4.10
oracle helidon Versi 2.4.0
oracle peoplesoft enterprise peopletools Versi 8.48
oracle peoplesoft enterprise peopletools Versi 8.57
oracle peoplesoft enterprise peopletools Versi 8.58
oracle peoplesoft enterprise peopletools Versi 8.59
oracle webcenter portal Versi 12.2.1.3.0
oracle webcenter portal Versi 12.2.1.4.0
netapp oncommand insight Semua versi
debian debian linux Versi 10.0
debian debian linux Versi 11.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 12:28 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.