netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

🗓️ 16 Nov 2022 15:09:28Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

Netty Bzip2Decoder flaw enables unbounded decompressed data, risking denial of service.

Reporter	Title	Published	Views	Family All 153
ibm	Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability CVE-2021-37136 in Netty netty-codec	28 Sep 202207:55	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities in Netty affect Apache Solr, Apache Zookeeper and Logstash shipped with IBM Operations Analytics - Log Analysis	6 Sep 202408:22	–	ibm
ibm	Security Bulletin: Vulnerabilities in Netty affect watsonx.data	25 Sep 202418:55	–	ibm
ibm	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	6 Jul 202613:46	–	ibm
ibm	Security Bulletin: IBM B2B Advanced Communications is affected by multiple vulnerabilities in log4j	13 Jan 202612:56	–	ibm
ibm	Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to several attack vectors due to its use of Apache Netty (CVE-2021-37136, CVE-2021-37137, CVE-2021-43797)	29 Jun 202214:09	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	27 Apr 202310:23	–	ibm
ibm	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	7 Jun 202316:53	–	ibm
ibm	Security Bulletin: Vulnerabilities in Netty-codec and Netty-handler might affect IBM Storage Defender Copy Data Management	26 Sep 202518:32	–	ibm
ibm	Security Bulletin: Mutiple Vulnerabilties Affecting Watson Machine Learning Accelerator on Cloud Pak for Data version	13 Nov 202315:22	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	candlepin	4.1.15-1.el8sat	candlepin-4.1.15-1.el8sat.noarch.rpm
Red Hat Enterprise Linux	8	noarch	candlepin-selinux	4.1.15-1.el8sat	candlepin-selinux-4.1.15-1.el8sat.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-37136
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-37136
cve	www.cve.org/CVERecord

28 Jun 2026 12:27Current

7.4High risk

Vulners AI Score7.4

CVSS 25

CVSS 3.17.5

EPSS0.05651

Netty Bzip2 decoder Decompressed data size Denial of service Remote attacker Security flaw Netty codec