CVE-2021-37136

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2021
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-371377.5The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer CVE-2021-37145.9A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via CVE-2021-371449.1CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect CVE-2021-371457.2A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker CVE-2021-371467.5An infinite loop in Open Robotics ros_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 allows remote attackers CVE-2021-371477.5Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affect CVE-2021-371487.5Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affect CVE-2021-371497.5Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affect CVE-2021-37157.8A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled chang CVE-2021-371507.5Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issu CVE-2021-371515.3CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain aut CVE-2021-371525.4Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files