What is the CVSS score of CVE-2021-37137?

CVE-2021-37137 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 6.3%.

Is there a patch available for CVE-2021-37137?

Yes, a patch is available for CVE-2021-37137. Update the affected software to the latest version immediately.

Netty CVE-2021-37137

HIGH

Uncontrolled Resource Consumption (CWE-400)

2021-10-19 reefs@jfrog.com

Denial Of Service Netty Banking Apis Banking Digital Experience Commerce Guided Search Communications Brm Elastic Charging Engine Communications Cloud Native Core Binding Support Function Communications Diameter Signaling Router Peoplesoft Enterprise Peopletools Webcenter Portal Quarkus Oncommand Insight Debian Linux

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Oct 19, 2021 - 15:15 nvd

HIGH 7.5

DescriptionNVD

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

AnalysisAI

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources. The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk. Affected products include: Netty, Oracle Banking Apis, Oracle Banking Digital Experience, Oracle Commerce Guided Search, Oracle Communications Brm - Elastic Charging Engine.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.