Log in Start free

Vulnerability · Published Jul 13, 2021 · Assigned by apache

CVE-2021-36090Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

High 7.5

In plain English

A high-severity security flaw in Apache Commons Compress from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.9% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)12.9%top 3.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libcommons-compress-java1.21-1DEBIAN-CVE-2021-36090
Debian:13libcommons-compress-java1.21-1DEBIAN-CVE-2021-36090
Debian:14libcommons-compress-java1.21-1DEBIAN-CVE-2021-36090
Mavenorg.apache.commons:commons-compress1.21GHSA-mc84-pj99-q6hh
Ubuntu:22.04:LTSlibcommons-compress-javano fix listedUBUNTU-CVE-2021-36090
Ubuntu:24.04:LTSlibcommons-compress-javano fix listedUBUNTU-CVE-2021-36090
Ubuntu:25.10libcommons-compress-javano fix listedUBUNTU-CVE-2021-36090
Ubuntu:26.04:LTSlibcommons-compress-javano fix listedUBUNTU-CVE-2021-36090
Ubuntu:26.10libcommons-compress-javano fix listedUBUNTU-CVE-2021-36090

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Commons Compress Apache Commons Compress – through 1.20

Weakness: CWE-130

References