Disclosure summary
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Source-reported weakness categories
CWE-400
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2021-37137
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| netty | netty | * {"versionEndExcluding":"4.1.68"} |
| oracle | banking_apis | * {"versionStartIncluding":"18.1","versionEndIncluding":"18.3"} |
| oracle | banking_apis | 19.1 |
| oracle | banking_apis | 19.2 |
| oracle | banking_apis | 20.1 |
| oracle | banking_apis | 21.1 |
| oracle | banking_digital_experience | 18.1 |
| oracle | banking_digital_experience | 18.2 |
| oracle | banking_digital_experience | 18.3 |
| oracle | banking_digital_experience | 19.1 |
| oracle | banking_digital_experience | 19.2 |
| oracle | banking_digital_experience | 20.1 |
| oracle | banking_digital_experience | 21.1 |
| oracle | commerce_guided_search | 11.3.2 |
| oracle | communications_brm_-_elastic_charging_engine | * {"versionEndExcluding":"12.0.0.4.6"} |
| oracle | communications_brm_-_elastic_charging_engine | 12.0.0.5.0 |
| oracle | communications_cloud_native_core_binding_support_function | 1.10.0 |
| oracle | communications_diameter_signaling_router | * {"versionStartIncluding":"8.0.0.0","versionEndIncluding":"8.5.0.2"} |
| oracle | peoplesoft_enterprise_peopletools | 8.57 |
| oracle | peoplesoft_enterprise_peopletools | 8.58 |
| oracle | peoplesoft_enterprise_peopletools | 8.59 |
| oracle | webcenter_portal | 12.2.1.3.0 |
| oracle | webcenter_portal | 12.2.1.4.0 |
| quarkus | quarkus | * {"versionEndExcluding":"2.2.4"} |
| netapp | oncommand_insight | - |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Third Party Advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.debian.org — Mailing List, Third Party Advisory
- security.netapp.com — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- github.com — Third Party Advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.debian.org — Mailing List, Third Party Advisory
- security.netapp.com — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
PUBLISHED 2021-10-19T11:15:07-04:00
MODIFIED 2026-10-08T18:17:10-04:00
INGESTED 2026-10-10T20:50:20-04:00