Vulnerability · Published Jul 13, 2021 · Assigned by apache
CVE-2021-35515Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
High 7.5
In plain English
A high-severity security flaw in Apache Commons Compress from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.6% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)11.6%top 3.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libcommons-compress-java | 1.21-1 | DEBIAN-CVE-2021-35515 |
| Debian:13 | libcommons-compress-java | 1.21-1 | DEBIAN-CVE-2021-35515 |
| Debian:14 | libcommons-compress-java | 1.21-1 | DEBIAN-CVE-2021-35515 |
| Maven | org.apache.commons:commons-compress | 1.21 | GHSA-7hfm-57qf-j43q |
| Ubuntu:22.04:LTS | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35515 |
| Ubuntu:24.04:LTS | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35515 |
| Ubuntu:25.10 | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35515 |
| Ubuntu:26.04:LTS | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35515 |
| Ubuntu:26.10 | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35515 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Commons Compress | 1.6 – before Apache Commons Compress* |
Weakness: CWE-834
References
- https://commons.apache.org/proper/commons-compress/security-reports.html x_refsource_MISC
- https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E x_refsource_MISC
- [oss-security] 20210713 CVE-2021-35515: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability mailing-list, x_refsource_MLIST
- [announce] 20210713 CVE-2021-35515: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability mailing-list, x_refsource_MLIST
- [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 mailing-list, x_refsource_MLIST
- [druid-commits] 20210726 [GitHub] [druid] suneet-s opened a new pull request #11496: Address CVE-2021-35515 CVE-2021-36090 mailing-list, x_refsource_MLIST
- [druid-commits] 20210726 [GitHub] [druid] suneet-s merged pull request #11496: Address CVE-2021-35515 CVE-2021-36090 mailing-list, x_refsource_MLIST
- [druid-commits] 20210726 [druid] branch master updated: Address CVE-2021-35515 CVE-2021-36090 (#11496) mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20211022-0001/ x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC