Memory Management Issue in Netty Framework's Snappy Decompression

CVE-2021-37137

What is CVE-2021-37137?

The Snappy frame decoder in the Netty Framework lacks proper restrictions on chunk lengths, potentially leading to excessive memory consumption. This vulnerability is triggered when manipulated input that decompresses to an unexpectedly large size is processed—either through a network stream or a file. Additionally, the decoder may buffer skippable chunks, causing substantial memory usage if large chunks are received, thus affecting the stability and reliability of the application.

References