CVE-2021-37137

netty, oracle banking apis, oracle banking digital experience +9 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-37137

Katalog CVE

CVSS 7.5 · High EPSS 6,6%

Kerentanan Uncontrolled Resource Consumption pada netty, oracle banking apis +10 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

Rincian

Terbit di NVD
19 Oktober 2021
Terakhir diubah
8 Oktober 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-400: Uncontrolled Resource Consumption
EPSS (30 hari)
6,6% peluang dieksploitasi; lebih tinggi dari 93,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
netty netty Semua versi sebelum 4.1.68
oracle banking apis Versi 18.1 hingga 18.3
oracle banking apis Versi 19.1
oracle banking apis Versi 19.2
oracle banking apis Versi 20.1
oracle banking apis Versi 21.1
oracle banking digital experience Versi 18.1
oracle banking digital experience Versi 18.2
oracle banking digital experience Versi 18.3
oracle banking digital experience Versi 19.1
oracle banking digital experience Versi 19.2
oracle banking digital experience Versi 20.1
oracle banking digital experience Versi 21.1
oracle commerce guided search Versi 11.3.2
oracle communications brm - elastic charging engine Semua versi sebelum 12.0.0.4.6
oracle communications brm - elastic charging engine Versi 12.0.0.5.0
oracle communications cloud native core binding support function Versi 1.10.0
oracle communications diameter signaling router Versi 8.0.0.0 hingga 8.5.0.2
oracle peoplesoft enterprise peopletools Versi 8.57
oracle peoplesoft enterprise peopletools Versi 8.58
oracle peoplesoft enterprise peopletools Versi 8.59
oracle webcenter portal Versi 12.2.1.3.0
oracle webcenter portal Versi 12.2.1.4.0
quarkus quarkus Semua versi sebelum 2.2.4
netapp oncommand insight Semua versi
debian debian linux Versi 10.0
debian debian linux Versi 11.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 12:28 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.