Bzip2 Decompression Vulnerability in Netty Affects Multiple Implementations

CVE-2021-37136

What is CVE-2021-37136?

The Bzip2 decompression function in the Netty framework is susceptible to vulnerabilities due to the lack of size restrictions on decompressed output data. This omission can lead to excessive memory allocation during decompression, resulting in Out Of Memory Errors (OOME) and potentially enabling denial of service (DoS) attacks. All users of the Bzip2Decoder component in their implementations are at risk, highlighting the need for immediate attention and remediation to ensure system stability and security.

References