Read the docs
TI-2021-15208 Aliases CVE-2021-37136GHSA-grg4-wf29-r9vv

Uncontrolled resource consumption in Netty

Priority MEDIUM 48CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 21 fixed, 15 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05908 93rd percentileScored 2026-11-07
Fix Partial Netty (The Netty project): 4.1.68Finalio.netty:netty-codec (Maven): 4.1.68.FinalRed Hat: 23 advisoriesRed Hat: 21 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The Netty projectNettybefore 4.1.68Final4.1.68FinalPatch availableCNA
—io.netty:netty-codec (Maven)before 4.1.68.Final4.1.68.FinalPatch availableGHSA-grg4-wf29-r9vv
—org.jboss.netty:netty (Maven)all versions—No fix listedGHSA-grg4-wf29-r9vv
—io.netty:netty (Maven)all versions—No fix listedGHSA-grg4-wf29-r9vv
  • Netty VendorThe Netty project Affected before 4.1.68Final Fixed in 4.1.68Final Patch available CNA
  • io.netty:netty-codec (Maven) Vendor— Affected before 4.1.68.Final Fixed in 4.1.68.Final Patch available GHSA-grg4-wf29-r9vv
  • org.jboss.netty:netty (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-grg4-wf29-r9vv
  • io.netty:netty (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-grg4-wf29-r9vv

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.68Vulnerablenetty
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 2.2.4Vulnerablequarkusio
cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*18.1 – 18.3VulnerableOracle
cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*20.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*21.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*18.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*18.2VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*18.3VulnerableOracle
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.68 Vulnerable ·netty
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.2.4 Vulnerable ·quarkusio
  • cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:* Versions 18.1 – 18.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:* Versions 18.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* Versions 18.3 Vulnerable ·Oracle
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*20.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*21.1VulnerableOracle
cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:*before 12.0.0.4.6VulnerableOracle
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12:0.0.5.0:*:*:*:*:*:*12 0.0.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0.0 – 8.5.0.2VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:*1.4.10VulnerableOracle
cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.48:*:*:*:*:*:*:*8.48VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:* Versions before 12.0.0.4.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12:0.0.5.0:*:*:*:*:*:* Versions 12 0.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.5.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:* Versions 1.4.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.48:*:*:*:*:*:*:* Versions 8.48 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA Netty (The Netty project) Fixed in 4.1.68Final
  • Fix · GHSA-grg4-wf29-r9vv io.netty:netty-codec (Maven) Fixed in 4.1.68.Final Advisory →

Red Hat 23 advisories

  • RHSA-2025:9582 Released 2025-06-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-glassfish-el-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-glassfish-el-impl-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate-5.1.17-3.Final_redhat_00004.1.ep7.el7 +22
  • RHSA-2025:9583 Released 2025-06-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.14 Security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jackson-annotations-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-core-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-databind-2.10.4-5.redhat_00006.1.el7eap +40
  • RHSA-2023:5165 Released 2023-09-14 · Red Hat rating Important
    Red Hat AMQ Streams 2.5.0 release and security update
    • Red Hat AMQ Streams 2.5.0
Show 20 more Red Hat advisories
  • RHSA-2023:3223 Released 2023-05-18 · Red Hat rating Important
    Red Hat AMQ Streams 2.4.0 release and security update
    • Red Hat AMQ Streams 2.4.0
  • RHSA-2022:8506 Released 2022-11-16 · Red Hat rating Important
    Satellite 6.12 Release
    • Red Hat Satellite 6.12 for RHEL 8 candlepin-4.1.15-1.el8sat, candlepin-selinux-4.1.15-1.el8sat, foreman-3.3.0.17-1.el8sat +19
  • RHSA-2022:6835 Released 2022-10-06 · Red Hat rating Important
    Service Registry (container images) release and security update [2.3.0.GA]
    • RHINT Service Registry 2.3.0 GA
  • RHSA-2022:5903 Released 2022-08-04 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.13.0 security update
    • RHPAM 7.13.0 async
  • RHSA-2022:4919 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el8eap, eap7-activemq-artemis-cli-2.16.0-9.redhat_00042.1.el8eap, eap7-activemq-artemis-commons-2.16.0-9.redhat_00042.1.el8eap +47
  • RHSA-2022:4918 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el7eap, eap7-activemq-artemis-cli-2.16.0-9.redhat_00042.1.el7eap, eap7-activemq-artemis-commons-2.16.0-9.redhat_00042.1.el7eap +47
  • RHSA-2022:4922 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update
    • Red Hat JBoss Enterprise Application Platform com.fasterxml.jackson.core.jackson-databind-2.12.6.1-redhat-00003.jar, com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-4.1.72.Final-redhat-00001.jar +8
  • RHSA-2022:2217 Released 2022-05-11 · Red Hat rating Moderate
    Red Hat OpenShift Logging Security and Bug update Release 5.3.7
    • OpenShift Logging 5.3 openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/elasticsearch6-rhel8 +1
  • RHSA-2022:2218 Released 2022-05-11 · Red Hat rating Moderate
    Openshift Logging Security and Bug update Release (5.2.10)
    • OpenShift Logging 5.2 openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/elasticsearch6-rhel8 +1
  • RHSA-2022:2216 Released 2022-05-11 · Red Hat rating Moderate
    Red Hat OpenShift Logging Security and Bug update Release 5.4.1
    • RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch-rhel8-operator, openshift-logging/elasticsearch6-rhel8
  • RHSA-2022:1013 Released 2022-03-22 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus 2.2.1 security update
    • RHINT Camel-Q 2.2.1
  • RHSA-2022:0589 Released 2022-02-21 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.2.5 release and security update
    • Red Hat build of Quarkus 2.2.5
  • RHSA-2022:0520 Released 2022-02-14 · Red Hat rating Moderate
    Red Hat Data Grid 8.3.0 security update
    • Red Hat Data Grid 8.3.0
  • RHSA-2022:0138 Released 2022-01-13 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.0.0 release and security update
    • Red Hat AMQ Streams 2.0.0
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:5129 Released 2021-12-14 · Red Hat rating Moderate
    Openshift Logging security and bug update (5.3.1)
    • OpenShift Logging 5.3 openshift-logging/elasticsearch6-rhel8
  • RHSA-2021:5127 Released 2021-12-14 · Red Hat rating Moderate
    Openshift Logging security and bug update (5.2.4)
    • OpenShift Logging 5.2 openshift-logging/elasticsearch6-rhel8
  • RHSA-2021:5128 Released 2021-12-14 · Red Hat rating Moderate
    Openshift Logging security and bug update (5.1.5)
    • OpenShift Logging 5.1 openshift-logging/elasticsearch6-rhel8
  • RHSA-2021:4851 Released 2021-11-30 · Red Hat rating Low
    Red Hat AMQ Broker 7.9.1 release and security update
    • Red Hat AMQ 7.9.1
  • RHSA-2021:3959 Released 2021-11-10 · Red Hat rating Moderate
    Red Hat build of Eclipse Vert.x 4.1.5 security update
    • Vert.x 4.1.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    The Netty project Netty 4.1.68Final

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2021-15209 Uncontrolled resource consumption in NettyPriority MEDIUM 48
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix yet
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat Single Sign-On 7AffectedNo fix yet
Red Hat build of QuarkusAffectedNo fix yet
OpenShift Logging 5.1Fixed RHSA-2021:5128
OpenShift Logging 5.2Fixed RHSA-2021:5127, RHSA-2022:2218
OpenShift Logging 5.3Fixed RHSA-2021:5129, RHSA-2022:2217
RHINT Camel-Q 2.2.1Fixed RHSA-2022:1013
RHINT Service Registry 2.3.0 GAFixed RHSA-2022:6835
RHOL 5.4 for RHEL 8Fixed RHSA-2022:2216
RHPAM 7.13.0 asyncFixed RHSA-2022:5903
Red Hat AMQ 7.9.1Fixed RHSA-2021:4851
Red Hat AMQ Streams 2.0.0Fixed RHSA-2022:0138
Red Hat AMQ Streams 2.4.0Fixed RHSA-2023:3223
Red Hat AMQ Streams 2.5.0Fixed RHSA-2023:5165
Red Hat Data Grid 8.3.0Fixed RHSA-2022:0520
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2022:4918
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2022:4919
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2022:4922
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:9582
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:9583
Red Hat Satellite 6.12 for RHEL 8Fixed RHSA-2022:8506
Red Hat build of Quarkus 2.2.5Fixed RHSA-2022:0589
Vert.x 4.1.5Fixed RHSA-2021:3959
Not affected: 10 products
  • OpenShift Logging 5.1
  • OpenShift Logging 5.2
  • OpenShift Logging 5.3
  • RHOL 5.4 for RHEL 8
  • Red Hat Integration Service Registry
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat OpenShift Container Platform 4
  • Red Hat Satellite 6.12 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-37136
  2. 2026-10-03 Alias added: GHSA-grg4-wf29-r9vv
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 3

Advisory 5

Other 18

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences