Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
Priority MEDIUM 53CWE-130Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.12945 96th percentileScored 2026-11-07
Fix Partial org.apache.commons:commons-compress (Maven): 1.21Red Hat: 2 advisoriesRed Hat: 2 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Commons Compress | Apache Commons Compress – 1.20 | — | No fix listed | CNA |
| — | org.apache.commons:commons-compress (Maven) | before 1.21 | 1.21 | Patch available | GHSA-mc84-pj99-q6hh |
- Apache Commons Compress VendorApache Affected Apache Commons Compress – 1.20 Fixed in — No fix listed CNA
- org.apache.commons:commons-compress (Maven) Vendor— Affected before 1.21 Fixed in 1.21 Patch available GHSA-mc84-pj99-q6hh
CPE configurations NVD · 69
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:* | 1.0 to before 1.21 | Vulnerable | Apache |
| cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:* | 18.1 – 18.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:* | 19.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:* | 19.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:* | 20.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:* | 21.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* | 18.1 – 18.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* | 19.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* | 19.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* | 20.1 | Vulnerable | Oracle |
- cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:* Versions 1.0 to before 1.21 Vulnerable ·Apache
- cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:* Versions 18.1 – 18.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* Versions 18.1 – 18.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
Show 59 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:* | 21.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:* | 2.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* | 2.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* | 2.6.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* | 2.7.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* | 2.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:* | 2.12.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* | 11.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.4:*:*:*:*:*:*:* | 12.0.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:* | 1.8.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* | 8.0.0 – 8.2.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.3:*:*:*:*:*:*:* | 8.2.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* | 8.0.0 – 8.2.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* | 7.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* | 7.4.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:* | 7.4.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:* | 7.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* | 8.0.6 – 8.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* | 8.0.8.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* | 8.0.8.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_enterprise_case_management:*:*:*:*:*:*:*:* | all versions | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2.0:*:*:*:*:*:*:* | 8.0.7.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1.0:*:*:*:*:*:*:* | 8.0.8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* | 14.0.0 – 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:12.4:*:*:*:*:*:*:* | 12.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:* | 11.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:* | 11.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:*:*:*:*:*:*:* | 11.2.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:* | 11.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:*:*:*:*:*:*:* | 11.3.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* | 8.57 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | 8.59 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* | 19.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* | 20.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* | 6.0.0.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:* | 6.0.0.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:* | 6.0.0.3.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.4:*:*:*:*:*:*:* Versions 12.0.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.3:*:*:*:*:*:*:* Versions 8.2.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2.0:*:*:*:*:*:*:* Versions 8.0.7.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1.0:*:*:*:*:*:*:* Versions 8.0.8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* Versions 14.0.0 – 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:12.4:*:*:*:*:*:*:* Versions 12.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:* Versions 11.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:*:*:*:*:*:*:* Versions 11.2.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:* Versions 11.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:*:*:*:*:*:*:* Versions 11.3.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* Versions 6.0.0.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:* Versions 6.0.0.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:* Versions 6.0.0.3.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-mc84-pj99-q6hh org.apache.commons:commons-compress (Maven) Fixed in 1.21 Advisory →
Red Hat 2 advisories
- RHSA-2022:5555 Released 2022-07-14 · Red Hat rating ModerateRHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 apache-commons-compress-1.21-1.2.el8ev, apache-commons-compress-javadoc-1.21-1.2.el8ev, ovirt-dependencies-4.5.2-1.el8ev +1
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 | Fixed | RHSA-2022:5555 |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
Not affected: 2 products
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-36090
- 2026-10-03 Alias added: GHSA-mc84-pj99-q6hh
- 2026-10-08 CISA SSVC decision points changed
References
Patch 3
Advisory 7
- https://commons.apache.org/proper/commons-compress/security-reports.html
- https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E
- [oss-security] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
- [oss-security] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20211022-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2021-36090
Other 51
- [announce] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
- [ant-user] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability
- [announce] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability
- [james-notifications] 20210714 [GitHub] [james-project] chibenwa opened a new pull request #537: [UPGRADE] Security upgrade: common-compress to 1.21
- [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21
- [druid-commits] 20210726 [GitHub] [druid] suneet-s opened a new pull request #11496: Address CVE-2021-35515 CVE-2021-36090
- [druid-commits] 20210726 [GitHub] [druid] suneet-s merged pull request #11496: Address CVE-2021-35515 CVE-2021-36090
- [druid-commits] 20210726 [druid] branch master updated: Address CVE-2021-35515 CVE-2021-36090 (#11496)
- [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400)
- [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
- [drill-dev] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090
- [drill-issues] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090
- [drill-dev] 20210804 [GitHub] [drill] luocooong opened a new pull request #2285: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090
- [drill-commits] 20210804 [drill] branch master updated: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090
- [drill-dev] 20210804 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090
- [drill-issues] 20210804 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090
- [drill-dev] 20210805 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090
- [drill-issues] 20210805 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090
- [tomcat-dev] 20210811 [GitHub] [tomcat-jakartaee-migration] ebourg commented on issue #23: Vulnerability with Apache Commons Compress v1.20
- [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1)
- https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38@%3Cuser.ant.apache.org%3E
- https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E
- https://security.netapp.com/advisory/ntap-20211022-0001
- https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949@%3Ccommits.drill.apache.org%3E
- https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E
- https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7@%3Cnotifications.james.apache.org%3E
- https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E
More Apache Commons Compress vulnerabilities
- TI-2021-14251 Apache Commons Compress 1.1 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
- TI-2019-09249 Infinite loop in Apache Commons Compress CVSS 3.1HIGH 7.5
- TI-2021-14250 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
- TI-2021-14249 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
- TI-2012-01871 Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing… CVSS 2.0MEDIUM 5.0
- TI-2024-16916 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file CVSS 3.1HIGH 8.1
Sources
- CVE-2021-36090 · CVE Program
- CVE-2021-36090 · NVD
- FIRST EPSS
- GHSA-mc84-pj99-q6hh · GitHub Advisory Database · CC BY 4.0
- CVE-2021-36090 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences