VulnerableCode Package Details - pkg:maven/io.netty/netty-codec@4.0.0

Search for packages

Package details: pkg:maven/io.netty/netty-codec@4.0.0

Essentials
History (1)

purl	pkg:maven/io.netty/netty-codec@4.0.0
Tags	Ghost

Next non-vulnerable version	4.1.68.Final
Latest non-vulnerable version	4.1.68.Final
Risk	4.0

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-yyyg-3z5x-vuay Aliases: CVE-2021-37137 GHSA-9vjp-v76f-g363	The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.	4.1.68.Final Affected by 0 other vulnerabilities. 4.1.68 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-yyyg-3z5x-vuay
Aliases:
CVE-2021-37137
GHSA-9vjp-v76f-g363

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

4.1.68.Final
Affected by 0 other vulnerabilities.

4.1.68
Affected by 0 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-03T16:52:24.772717+00:00	GHSA Importer	Affected by	VCID-yyyg-3z5x-vuay	https://github.com/advisories/GHSA-9vjp-v76f-g363	37.0.0