Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
Priority MEDIUM 46CWE-834Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Why it matters now
EPSS 0.11567 96th percentileScored 2026-11-07
Fix Partial org.apache.commons:commons-compress (Maven): 1.21Red Hat: 2 advisoriesRed Hat: 2 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Commons Compress | 1.6 and later | — | No fix listed | CNA |
| — | org.apache.commons:commons-compress (Maven) | before 1.21 | 1.21 | Patch available | GHSA-7hfm-57qf-j43q |
- Apache Commons Compress VendorApache Affected 1.6 and later Fixed in — No fix listed CNA
- org.apache.commons:commons-compress (Maven) Vendor— Affected before 1.21 Fixed in 1.21 Patch available GHSA-7hfm-57qf-j43q
CPE configurations NVD · 47
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:* | 1.6 – 1.20 | Vulnerable | Apache |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* | 18.1 – 18.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* | 19.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* | 20.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:* | 21.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:* | 2.7.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:* Versions 1.6 – 1.20 Vulnerable ·Apache
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* Versions 18.1 – 18.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
Show 37 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* | 2.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* | 11.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.4:*:*:*:*:*:*:* | 12.0.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:* | 1.8.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* | 8.0.0 – 8.2.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* | 8.0.0 – 8.2.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* | 8.0.8.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* | 8.0.8.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2.0:*:*:*:*:*:*:* | 8.0.7.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1.0:*:*:*:*:*:*:* | 8.0.8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* | 14.0.0 – 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:* | 12.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:* | 11.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:* | 11.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:*:*:*:*:*:*:* | 11.2.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:* | 11.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:*:*:*:*:*:*:* | 11.3.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* | 8.57 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | 8.59 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* | 19.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* | 20.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* | 6.0.0.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:* | 6.0.0.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:* | 6.0.0.3.1 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.4:*:*:*:*:*:*:* Versions 12.0.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2.0:*:*:*:*:*:*:* Versions 8.0.7.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1.0:*:*:*:*:*:*:* Versions 8.0.8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* Versions 14.0.0 – 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:* Versions 11.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:*:*:*:*:*:*:* Versions 11.2.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:* Versions 11.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:*:*:*:*:*:*:* Versions 11.3.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* Versions 6.0.0.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:* Versions 6.0.0.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:* Versions 6.0.0.3.1 Vulnerable ·Oracle
- cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-7hfm-57qf-j43q org.apache.commons:commons-compress (Maven) Fixed in 1.21 Advisory →
Red Hat 2 advisories
- RHSA-2022:5555 Released 2022-07-14 · Red Hat rating ModerateRHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 apache-commons-compress-1.21-1.2.el8ev, apache-commons-compress-javadoc-1.21-1.2.el8ev, ovirt-dependencies-4.5.2-1.el8ev +1
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Apache Commons Compress Apache Commons Compress*
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2021-14251 Apache Commons Compress 1.1 to 1.20 denial of service vulnerabilityPriority MEDIUM 52
- TI-2021-14250 Apache Commons Compress 1.6 to 1.20 denial of service vulnerabilityPriority MEDIUM 47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 | Fixed | RHSA-2022:5555 |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
Not affected: 2 products
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35515
- 2026-10-03 Alias added: GHSA-7hfm-57qf-j43q
References
Patch 4
Advisory 5
- https://commons.apache.org/proper/commons-compress/security-reports.html
- https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E
- [oss-security] 20210713 CVE-2021-35515: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
- https://security.netapp.com/advisory/ntap-20211022-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2021-35515
Other 27
- [announce] 20210713 CVE-2021-35515: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
- [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21
- [druid-commits] 20210726 [GitHub] [druid] suneet-s opened a new pull request #11496: Address CVE-2021-35515 CVE-2021-36090
- [druid-commits] 20210726 [GitHub] [druid] suneet-s merged pull request #11496: Address CVE-2021-35515 CVE-2021-36090
- [druid-commits] 20210726 [druid] branch master updated: Address CVE-2021-35515 CVE-2021-36090 (#11496)
- [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400)
- [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1)
- https://security.netapp.com/advisory/ntap-20211022-0001
- https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rbaea15ddc5a7c0c6b66660f1d6403b28595e2561bb283eade7d7cd69@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E
More Apache Commons Compress vulnerabilities
- TI-2021-14540 Apache Commons Compress 1.0 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
- TI-2021-14251 Apache Commons Compress 1.1 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
- TI-2019-09249 Infinite loop in Apache Commons Compress CVSS 3.1HIGH 7.5
- TI-2021-14250 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
- TI-2012-01871 Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing… CVSS 2.0MEDIUM 5.0
- TI-2024-16916 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file CVSS 3.1HIGH 8.1
Sources
- CVE-2021-35515 · CVE Program
- CVE-2021-35515 · NVD
- FIRST EPSS
- GHSA-7hfm-57qf-j43q · GitHub Advisory Database · CC BY 4.0
- CVE-2021-35515 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences