{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"org.jboss.netty:netty","cve_ids":["CVE-2021-37137"],"ecosystem":"Maven","epss":0.06565,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-9vjp-v76f-g363","id":"tcs_01M5N8QVFQ65GCT653BEQ2SYG5","modified_at":"2026-07-08T06:27:59.313512567Z","published_at":"2021-09-09T17:11:31Z","references":["https://osv.dev/vulnerability/GHSA-9vjp-v76f-g363","https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363","https://nvd.nist.gov/vuln/detail/CVE-2021-37137","https://github.com/netty/netty/commit/6da4956b31023ae967451e1d94ff51a746a9194f","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.debian.org/security/2023/dsa-5316","https://security.netapp.com/advisory/ntap-20220210-0012","https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html","https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e@%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d@%3Ccommits.druid.apache.org%3E","https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L79","https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L185","https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L171","https://github.com/netty/netty"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-9vjp-v76f-g363#Maven/org.jboss.netty:netty","url":"https://osv.dev/vulnerability/GHSA-9vjp-v76f-g363"}],"summary":"SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way"}