Log in Start free

Vulnerability · Published Jul 14, 2021 · Assigned by apache

CVE-2021-36373Apache Ant TAR archive denial of service vulnerability

Medium 5.5

In plain English

A medium-severity security flaw in Apache Ant from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)2.5%top 15.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20apache-ant1.10.11-r0ALPINE-CVE-2021-36373
Alpine:v3.21apache-ant1.10.11-r0ALPINE-CVE-2021-36373
Alpine:v3.22apache-ant1.10.11-r0ALPINE-CVE-2021-36373
Alpine:v3.23apache-ant1.10.11-r0ALPINE-CVE-2021-36373
Alpine:v3.24apache-ant1.10.11-r0ALPINE-CVE-2021-36373
Debian:12ant1.10.11-1DEBIAN-CVE-2021-36373
Debian:13ant1.10.11-1DEBIAN-CVE-2021-36373
Debian:14ant1.10.11-1DEBIAN-CVE-2021-36373
Mavenorg.apache.ant:ant1.10.11GHSA-q5r4-cfpx-h6fh
Mavenorg.apache.ant:ant1.9.16GHSA-q5r4-cfpx-h6fh
Ubuntu:22.04:LTSantno fix listedUBUNTU-CVE-2021-36373
Ubuntu:24.04:LTSantno fix listedUBUNTU-CVE-2021-36373
Ubuntu:25.10antno fix listedUBUNTU-CVE-2021-36373
Ubuntu:26.04:LTSantno fix listedUBUNTU-CVE-2021-36373
Ubuntu:26.10antno fix listedUBUNTU-CVE-2021-36373

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Ant Apache Ant 1.9.x – through 1.9.15Apache Ant 1.10.x – through 1.10.10

Weakness: CWE-130

References