CVE-2021-37136: Debian Linux

High severity, CVSS 7.5. EPSS: 5.9% chance of exploitation in the next 30 days.

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

Affected products

Debian Debian Linux: version 10.0 only; version 11.0 only
Netapp Oncommand Insight: affected versions not specified
Netty Netty: before 4.1.68 (fixed in 4.1.68)
Oracle Banking Apis: from 18.1, up to and including 18.3; version 19.1 only; version 19.2 only; version 20.1 only; version 21.1 only
Oracle Banking Digital Experience: version 18.1 only; version 18.2 only; version 18.3 only; version 19.1 only; version 19.2 only; version 20.1 only; …
Oracle Coherence: version 12.2.1.4.0 only; version 14.1.1.0.0 only
Oracle Commerce Guided Search: version 11.3.2 only
Oracle Communications Brm - Elastic Charging Engine: before 12.0.0.4.6 (fixed in 12.0.0.4.6); version 12 only
Oracle Communications Cloud Native Core Binding Support Function: version 1.10.0 only; version 1.11.0 only
Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.8.0 only
Oracle Communications Cloud Native Core Policy: version 1.15.0 only
Oracle Communications Cloud Native Core Security Edge Protection Proxy: version 1.7.0 only
Oracle Communications Cloud Native Core Unified Data Repository: version 1.15.0 only
Oracle Communications Diameter Signaling Router: from 8.0.0.0, up to and including 8.5.0.2
Oracle Communications Instant Messaging Server: version 8.1 only
Oracle Helidon: version 1.4.10 only; version 2.4.0 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.48 only; version 8.57 only; version 8.58 only; version 8.59 only
Oracle Webcenter Portal: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Quarkus Quarkus: before 2.2.4 (fixed in 2.2.4)

Published 2021-10-19. Last modified 2026-10-08.