Vulnerability · Published Jul 13, 2021 · Assigned by apache
CVE-2021-35517Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
High 7.5
In plain English
A high-severity security flaw in Apache Commons Compress from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.6% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)10.6%top 4.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libcommons-compress-java | 1.21-1 | DEBIAN-CVE-2021-35517 |
| Debian:13 | libcommons-compress-java | 1.21-1 | DEBIAN-CVE-2021-35517 |
| Debian:14 | libcommons-compress-java | 1.21-1 | DEBIAN-CVE-2021-35517 |
| Maven | org.apache.commons:commons-compress | 1.21 | GHSA-xqfj-vm6h-2x34 |
| Ubuntu:22.04:LTS | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35517 |
| Ubuntu:24.04:LTS | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35517 |
| Ubuntu:25.10 | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35517 |
| Ubuntu:26.04:LTS | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35517 |
| Ubuntu:26.10 | libcommons-compress-java | no fix listed | UBUNTU-CVE-2021-35517 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Commons Compress | 1.1 – before Apache Commons Compress* |
Weakness: CWE-130
References
- https://commons.apache.org/proper/commons-compress/security-reports.html x_refsource_MISC
- https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E x_refsource_MISC
- [oss-security] 20210713 CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability mailing-list, x_refsource_MLIST
- [announce] 20210713 CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability mailing-list, x_refsource_MLIST
- [ant-user] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability mailing-list, x_refsource_MLIST
- [announce] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability mailing-list, x_refsource_MLIST
- [oss-security] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability mailing-list, x_refsource_MLIST
- [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list, x_refsource_MLIST
- [flink-issues] 20210908 [GitHub] [flink] MartijnVisser opened a new pull request #17194: [FLINK-24034] Upgrade commons-compress to 1.21 and other apache.commons updates mailing-list, x_refsource_MLIST
- [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20211022-0001/ x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC