High 7.5Published Oct 18, 2021

CVE-2021-37137The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

Updated under an hour ago (Oct 27, 2026, 8:00 AM ET)

Does this affect you?

It affects The Netty project Netty and 12 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for The Netty project Netty

Exploited in the last 30 days

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

CVSS: 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-400
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: JFROG
NVD analysis: Modified
Record last updated: Oct 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

The Netty project Netty netty_project:netty (from the name)	from unspecified before 4.1.68Final	CNA record
netty netty netty:netty	before 4.1.68	NVD
oracle banking_apis oracle:banking_apis	from 18.1 through 18.3; 19.1; 19.2; 20.1; 21.1	NVD
oracle banking_digital_experience oracle:banking_digital_experience	18.1; 18.2; 18.3; 19.1; 19.2; 20.1; 21.1	NVD
oracle commerce_guided_search oracle:commerce_guided_search	11.3.2	NVD
oracle communications_brm_-_elastic_charging_engine oracle:communications_brm_-_elastic_charging_engine	before 12.0.0.4.6; 12.0.0.5.0	NVD
oracle communications_cloud_native_core_binding_support_function oracle:communications_cloud_native_core_binding_support_function	1.10.0	NVD
oracle communications_diameter_signaling_router oracle:communications_diameter_signaling_router	from 8.0.0.0 through 8.5.0.2	NVD
oracle peoplesoft_enterprise_peopletools oracle:peoplesoft_enterprise_peopletools	8.57; 8.58; 8.59	NVD
oracle webcenter_portal oracle:webcenter_portal	12.2.1.3.0; 12.2.1.4.0	NVD
1–10 of 13

References

References

https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363
https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3Cdev.tinkerpop.apache.org%3E	mailing-list
https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3E	mailing-list
https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3Ccommits.druid.apache.org%3E	mailing-list
https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3Ccommits.druid.apache.org%3E	mailing-list
https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3Ccommits.druid.apache.org%3E	mailing-list
https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3Ccommits.druid.apache.org%3E	mailing-list
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://security.netapp.com/advisory/ntap-20220210-0012/
1–10 of 13

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.