Infinite loop in Apache Commons Compress
Priority MEDIUM 49CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
Why it matters now
EPSS 0.16157 96th percentileScored 2026-11-07
Fix Partial org.apache.commons:commons-compress (Maven): 1.19Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Commons Compress | 1.15 to 1.18 | — | No fix listed | CNA |
| — | org.apache.commons:commons-compress (Maven) | 1.15 to before 1.19 | 1.19 | Patch available | GHSA-53x6-4x5p-rrvv |
| — | io.github.1tchy.java9modular.org.apache.commons:commons-compress (Maven) | — | — | No fix listed | GHSA-53x6-4x5p-rrvv |
- Apache Commons Compress VendorApache Affected 1.15 to 1.18 Fixed in — No fix listed CNA
- org.apache.commons:commons-compress (Maven) Vendor— Affected 1.15 to before 1.19 Fixed in 1.19 Patch available GHSA-53x6-4x5p-rrvv
- io.github.1tchy.java9modular.org.apache.commons:commons-compress (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-53x6-4x5p-rrvv
CPE configurations NVD · 38
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:* | 1.15 – 1.18 | Vulnerable | Apache |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:banking_payments:*:*:*:*:*:*:*:* | 14.1.0 – 14.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* | 2.6.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:* | 2.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:* | 2.8.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* | 2.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_ip_service_activator:7.3.0:*:*:*:*:*:*:* | 7.3.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:* Versions 1.15 – 1.18 Vulnerable ·Apache
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:banking_payments:*:*:*:*:*:*:*:* Versions 14.1.0 – 14.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_ip_service_activator:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
Show 28 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_ip_service_activator:7.4.0:*:*:*:*:*:*:* | 7.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* | 18.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:* | 21.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:* | 12.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:* | 12.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:* | 14.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:14.1.0:*:*:*:*:*:*:* | 14.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* | 12.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:* | 11.1.2.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.56:*:*:*:*:*:*:* | 8.56 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.57:*:*:*:*:*:*:* | 8.57 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 18.8.0 – 18.8.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:* | 19.12.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* | 17.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:* | 18.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:*:*:*:*:*:*:* | 19.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:communications_ip_service_activator:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:* Versions 21.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:* Versions 12.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:* Versions 14.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:14.1.0:*:*:*:*:*:*:* Versions 14.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:* Versions 11.1.2.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 18.8.0 – 18.8.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:* Versions 19.12.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-53x6-4x5p-rrvv org.apache.commons:commons-compress (Maven) Fixed in 1.19 Advisory →
Red Hat 1 advisory
- RHSA-2021:3140 Released 2021-08-11 · Red Hat rating ModerateRed Hat Fuse 7.9.0 release and security update
- Red Hat Fuse 7.9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7.9 | Fixed | RHSA-2021:3140 |
Not affected: 14 products
- A-MQ Clients 2
- Red Hat BPM Suite 6
- Red Hat Data Grid 8
- Red Hat Decision Manager 7
- Red Hat Enterprise Linux 7
- Red Hat Integration Camel K 1
- Red Hat Integration Service Registry
- Red Hat JBoss BRMS 6
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat Process Automation 7
- Red Hat Software Collections
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12402
- 2026-10-03 Alias added: GHSA-53x6-4x5p-rrvv
References
Advisory 11
- FEDORA-2019-c96a8d12b0
- FEDORA-2019-da0eac1eb6
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-12402
Other 43
- [creadur-commits] 20191022 [creadur-rat] branch master updated: RAT-258: Update to latest commons-compress to fix CVE-2019-12402
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities
- [flink-issues] 20200306 [GitHub] [flink] nielsbasjes opened a new pull request #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200306 [GitHub] [flink] flinkbot edited a comment on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200306 [GitHub] [flink] flinkbot commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200310 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200311 [GitHub] [flink] nielsbasjes commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200311 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200311 [GitHub] [flink] flinkbot edited a comment on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200311 [GitHub] [flink] nielsbasjes edited a comment on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200312 [GitHub] [flink] zentol commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200312 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200313 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200313 [GitHub] [flink] zentol commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [flink-issues] 20200313 [GitHub] [flink] GJL closed pull request #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1
- [lucene-solr-user] 20200320 Re: CVEs (vulnerabilities) that apply to Solr 8.4.1
- [brooklyn-dev] 20200403 [GitHub] [brooklyn-server] nakomis opened a new pull request #1089: Bumps commons-compress version
- https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b%40%3Cdev.commons.apache.org%3E
- https://security.netapp.com/advisory/ntap-20230818-0001/
- https://security.netapp.com/advisory/ntap-20230818-0001
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WZB3GB7YXIOUKIOQ27VTIP6KKGJJ3CKL
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7
- https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55@%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/re13bd219dd4b651134f6357f12bd07a0344eea7518c577bbdd185265@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/rdebc1830d6c09c11d5a4804ca26769dbd292d17d361c61dea50915f0@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/rd3f99d732baed459b425fb0a9e9e14f7843c9459b12037e4a9d753b5@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/rcc35ab6be300365de5ff9587e0479d10d7d7c79070921837e3693162@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r972f82d821b805d04602976a9736c01b6bf218cfe0c3f48b472db488@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r7af60fbd8b2350d49d14e53a3ab2801998b9d1af2d6fcac60b060a53@%3Cdev.brooklyn.apache.org%3E
- https://lists.apache.org/thread.html/r5caf4fcb69d2749225391e61db7216282955204849ba94f83afe011f@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r590c15cebee9b8e757e2f738127a9a71e48ede647a3044c504e050a4@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r5103b1c9242c0f812ac96e524344144402cbff9b6e078d1557bc7b1e@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r4363c994c8bca033569a98da9218cc0c62bb695c1e47a98e5084e5a0@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r25422df9ad22fec56d9eeca3ab8bd6d66365e9f6bfe311b64730edf5@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r233267e24519bacd0f9fb9f61a1287cb9f4bcb6e75d83f34f405c521@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r21d64797914001119d2fc766b88c6da181dc2308d20f14e7a7f46117@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/r05cf37c1e1e662e968cfece1102fcd50fe207181fdbf2c30aadfafd3@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea@%3Ccommits.creadur.apache.org%3E
- https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b@%3Cdev.commons.apache.org%3E
- https://github.com/jensdietrich/xshady-release/tree/main/CVE-2019-12402
More Apache Commons Compress vulnerabilities
- TI-2021-14540 Apache Commons Compress 1.0 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
- TI-2021-14251 Apache Commons Compress 1.1 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
- TI-2021-14250 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
- TI-2021-14249 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
- TI-2012-01871 Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing… CVSS 2.0MEDIUM 5.0
- TI-2024-16916 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file CVSS 3.1HIGH 8.1
Sources
- CVE-2019-12402 · CVE Program
- CVE-2019-12402 · NVD
- FIRST EPSS
- GHSA-53x6-4x5p-rrvv · GitHub Advisory Database · CC BY 4.0
- CVE-2019-12402 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences