Vulnerability · Published Jul 13, 2021 · Assigned by apache
CVE-2021-35516Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
High 7.5
In plain English
A high-severity security flaw in Apache Commons Compress from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.4% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)12.4%top 3.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libcommons-compress-java | 1.21-1 | DEBIAN-CVE-2021-35516 |
| Debian:13 | libcommons-compress-java | 1.21-1 | DEBIAN-CVE-2021-35516 |
| Debian:14 | libcommons-compress-java | 1.21-1 | DEBIAN-CVE-2021-35516 |
| Maven | org.apache.commons:commons-compress | 1.21 | GHSA-crv7-7245-f45f |
| Ubuntu:22.04:LTS | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35516 |
| Ubuntu:24.04:LTS | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35516 |
| Ubuntu:25.10 | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35516 |
| Ubuntu:26.04:LTS | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35516 |
| Ubuntu:26.10 | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35516 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Commons Compress | 1.6 – before Apache Commons Compress* |
Weakness: CWE-130
References
- https://commons.apache.org/proper/commons-compress/security-reports.html x_refsource_MISC
- https://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3E x_refsource_MISC
- [oss-security] 20210713 CVE-2021-35516: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability mailing-list, x_refsource_MLIST
- [announce] 20210713 CVE-2021-35516: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability mailing-list, x_refsource_MLIST
- [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20211022-0001/ x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC