{"url":"http://public2.vulnerablecode.io/api/packages/59329?format=json","purl":"pkg:maven/io.helidon/helidon-dependencies@2.4.1","type":"maven","namespace":"io.helidon","name":"helidon-dependencies","version":"2.4.1","qualifiers":{},"subpath":"","is_vulnerable":false,"next_non_vulnerable_version":null,"latest_non_vulnerable_version":null,"affected_by_vulnerabilities":[],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41448?format=json","vulnerability_id":"VCID-87dy-43px-e7gv","summary":"Uncontrolled Resource Consumption\nThe Bzip2 decompression decoder function does not allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack","references":[{"reference_url":"https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294"},{"reference_url":"https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305"},{"reference_url":"https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80"},{"reference_url":"https://github.com/netty/netty/commit/41d3d61a61608f2223bb364955ab2045dd5e4020","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/netty/netty/commit/41d3d61a61608f2223bb364955ab2045dd5e4020"},{"reference_url":"https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d@%3Ccommits.druid.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d@%3Ccommits.druid.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb@%3Ccommits.druid.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb@%3Ccommits.druid.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04@%3Ccommits.druid.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04@%3Ccommits.druid.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3Ccommits.druid.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3Ccommits.druid.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16@%3Ccommits.druid.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16@%3Ccommits.druid.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e@%3Cdev.tinkerpop.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e@%3Cdev.tinkerpop.apache.org%3E"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html","reference_id":"","reference_type":"","scores":[],"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html"},{"reference_url":"https://security.netapp.com/advisory/ntap-20220210-0012/","reference_id":"","reference_type":"","scores":[],"url":"https://security.netapp.com/advisory/ntap-20220210-0012/"},{"reference_url":"https://www.debian.org/security/2023/dsa-5316","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2023/dsa-5316"},{"reference_url":"https://www.oracle.com/security-alerts/cpuapr2022.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"reference_url":"https://www.oracle.com/security-alerts/cpujan2022.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"reference_url":"https://www.oracle.com/security-alerts/cpujul2022.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37136","reference_id":"CVE-2021-37136","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37136"},{"reference_url":"https://github.com/advisories/GHSA-grg4-wf29-r9vv","reference_id":"GHSA-grg4-wf29-r9vv","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-grg4-wf29-r9vv"},{"reference_url":"https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv","reference_id":"GHSA-grg4-wf29-r9vv","reference_type":"","scores":[],"url":"https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59328?format=json","purl":"pkg:maven/io.helidon/helidon-dependencies@1.4.11","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/io.helidon/helidon-dependencies@1.4.11"},{"url":"http://public2.vulnerablecode.io/api/packages/59329?format=json","purl":"pkg:maven/io.helidon/helidon-dependencies@2.4.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/io.helidon/helidon-dependencies@2.4.1"}],"aliases":["CVE-2021-37136","GHSA-grg4-wf29-r9vv"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-87dy-43px-e7gv"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/io.helidon/helidon-dependencies@2.4.1"}