CVE-2021-37137: Debian Linux

High severity, CVSS 7.5. EPSS: 6.6% chance of exploitation in the next 30 days.

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Netapp Oncommand Insight: affected versions not specified
• Netty Netty: before 4.1.68 (fixed in 4.1.68)
• Oracle Banking Apis: from 18.1, up to and including 18.3; version 19.1 only; version 19.2 only; version 20.1 only; version 21.1 only
• Oracle Banking Digital Experience: version 18.1 only; version 18.2 only; version 18.3 only; version 19.1 only; version 19.2 only; version 20.1 only; …
• Oracle Commerce Guided Search: version 11.3.2 only
• Oracle Communications Brm - Elastic Charging Engine: before 12.0.0.4.6 (fixed in 12.0.0.4.6); version 12.0.0.5.0 only
• Oracle Communications Cloud Native Core Binding Support Function: version 1.10.0 only
• Oracle Communications Diameter Signaling Router: from 8.0.0.0, up to and including 8.5.0.2
• Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
• Oracle Webcenter Portal: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Quarkus Quarkus: before 2.2.4 (fixed in 2.2.4)

Published 2021-10-19. Last modified 2026-10-08.