Resource Exhaustion The advisory has been revoked - it doesn't affect any version of package hadoop-fips-3.3.6 (opens in a new tab)

Threat Intelligence

6.57% (94^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-CHAINGUARDLATEST-HADOOPFIPS336-9511503
published24 Mar 2025
disclosed19 Oct 2021

Report a new vulnerability Found a mistake?

Introduced: 19 Oct 2021

CVE-2021-37137 (opens in a new tab) CWE-400 (opens in a new tab)

Amendment

The Chainguard security team deemed this advisory irrelevant for Chainguard:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream hadoop-fips-3.3.6 package and not the hadoop-fips-3.3.6 package as distributed by Chainguard.

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.