Hey there.
SonarQube bundles a version of Elasticsearch (v7.17.8) which bundles this version of Netty.
SonarQube is not vulnerable to either CVE-2021-37136 or CVE-2021-37137, as Elasticsearch itself doesn’t use the functionality that these vulnerabilities relate to (the Bzip2Decoder or SnappyFrameDecoder).
There are no plans to upgrade the version of Elasticsearch to a new major version until SonarQube v10.x.