Apache Ant ZIP, and ZIP based, archive denial of service vulerability
Priority LOW 30CWE-130Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 18 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Why it matters now
EPSS 0.02642 85th percentileScored 2026-11-07
Fix Partial org.apache.ant:ant (Maven): 1.9.16, 1.10.11Red Hat: 18 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Ant | 1.4 and later; Apache Ant 1.9.x – 1.9.15; Apache Ant 1.10.x – 1.10.10 | — | No fix listed | CNA |
| — | org.apache.ant:ant (Maven) | 1.9.0 to before 1.9.16 | 1.9.16 | Patch available | GHSA-5v34-g2px-j4fw |
| — | org.apache.ant:ant (Maven) | 1.10.0 to before 1.10.11 | 1.10.11 | Patch available | GHSA-5v34-g2px-j4fw |
- Apache Ant VendorApache Affected 1.4 and later; Apache Ant 1.9.x – 1.9.15; Apache Ant 1.10.x – 1.10.10 Fixed in — No fix listed CNA
- org.apache.ant:ant (Maven) Vendor— Affected 1.9.0 to before 1.9.16 Fixed in 1.9.16 Patch available GHSA-5v34-g2px-j4fw
- org.apache.ant:ant (Maven) Vendor— Affected 1.10.0 to before 1.10.11 Fixed in 1.10.11 Patch available GHSA-5v34-g2px-j4fw
CPE configurations NVD · 74
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:ant:*:*:*:*:*:*:*:* | 1.9.0 to before 1.9.16; 1.10.0 to before 1.10.11 | Vulnerable | Apache |
| cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* | 6.2.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* | 9.3.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:* | 1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* | 1.11.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* | 8.0.0 – 8.1.0; 8.2.0 – 8.2.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:* | 7.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_order_and_service_management:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Oracle |
- cpe:2.3:a:apache:ant:*:*:*:*:*:*:*:* Versions 1.9.0 to before 1.9.16; 1.10.0 to before 1.10.11 Vulnerable ·Apache
- cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.1.0; 8.2.0 – 8.2.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_order_and_service_management:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Oracle
Show 64 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:* | 7.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* | 7.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* | 7.4.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:* | 7.4.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:* | 7.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:* | 11.1.1.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* | 8.0.6 – 8.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:health_sciences_information_manager:*:*:*:*:*:*:*:* | 3.0.1 – 3.0.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:health_sciences_information_manager:3.0.0.1:*:*:*:*:*:*:* | 3.0.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:* | 11.0 – 11.3.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* | 19.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* | 20.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:* | 3.6.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:*:*:*:*:*:*:* | 3.2.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:*:*:*:*:*:*:* | 11.1.1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_advanced_inventory_planning:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* | 14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_bulk_data_integration:19.0.1:*:*:*:*:*:*:* | 19.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:* | 14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:* | 19.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:* | 20.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:*:*:*:*:*:*:* | 13.2.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:* | 14.1.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_financial_integration:15.0.4.0:*:*:*:*:*:*:* | 15.0.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_financial_integration:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:* | 14.1.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:15.0.4.0:*:*:*:*:*:*:* | 15.0.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:19.0.1.0:*:*:*:*:*:*:* | 19.0.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:*:*:*:*:*:*:* | 16.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:* | 19.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:* | 14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:* | 14.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:* | 15.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:* | 14.1.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:15.0.4.0:*:*:*:*:*:*:* | 15.0.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:19.0.1.0:*:*:*:*:*:*:* | 19.0.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_store_inventory_management:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_store_inventory_management:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_store_inventory_management:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* | 16.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* | 17.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* | 18.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* | 19.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:* | 20.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* | before 11.2.2.8.27 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* | 4.3.0.1.0 – 4.3.0.6.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:* | 4.2.0.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:* | 4.2.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* | 4.4.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* | 4.4.0.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* | 4.4.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* | 6.0.0.1.1 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:* Versions 11.1.1.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:health_sciences_information_manager:*:*:*:*:*:*:*:* Versions 3.0.1 – 3.0.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:health_sciences_information_manager:3.0.0.1:*:*:*:*:*:*:* Versions 3.0.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:* Versions 11.0 – 11.3.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:* Versions 3.6.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:*:*:*:*:*:*:* Versions 3.2.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_advanced_inventory_planning:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_bulk_data_integration:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:*:*:*:*:*:*:* Versions 13.2.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_financial_integration:15.0.4.0:*:*:*:*:*:*:* Versions 15.0.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_financial_integration:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:15.0.4.0:*:*:*:*:*:*:* Versions 15.0.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:19.0.1.0:*:*:*:*:*:*:* Versions 19.0.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:* Versions 14.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:15.0.4.0:*:*:*:*:*:*:* Versions 15.0.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:19.0.1.0:*:*:*:*:*:*:* Versions 19.0.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_store_inventory_management:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_store_inventory_management:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_store_inventory_management:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* Versions 16.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* Versions before 11.2.2.8.27 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* Versions 4.3.0.1.0 – 4.3.0.6.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:* Versions 4.2.0.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:* Versions 4.2.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* Versions 4.4.0.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* Versions 4.4.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* Versions 6.0.0.1.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-5v34-g2px-j4fw org.apache.ant:ant (Maven) Fixed in 1.9.16 Advisory →
- Fix · GHSA-5v34-g2px-j4fw org.apache.ant:ant (Maven) Fixed in 1.10.11 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Decision Manager 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-36374
- 2026-10-03 Alias added: GHSA-5v34-g2px-j4fw
References
Patch 5
Advisory 3
Other 9
- [groovy-commits] 20210714 [groovy] 08/09: GROOVY-10169: Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)
- [groovy-commits] 20210715 [groovy] 02/07: GROOVY-10169: Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)
- [groovy-notifications] 20210715 [jira] [Resolved] (GROOVY-10169) Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)
- [myfaces-dev] 20210830 [GitHub] [myfaces-tobago] lofwyr14 opened a new pull request #1215: build: CVE fix
- https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a@%3Ccommits.groovy.apache.org%3E
- https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d@%3Ccommits.groovy.apache.org%3E
- https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a@%3Cnotifications.groovy.apache.org%3E
- https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6@%3Cdev.myfaces.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210819-0007
More Apache Ant vulnerabilities
- TI-2020-09639 Injection in Apache Ant CVSS 3.1HIGH 7.5
- TI-2026-54427 Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write CVSS 3.1HIGH 7.4
- TI-2020-01869 Exposure of resource to wrong sphere in Apache Ant CVSS 3.1MEDIUM 6.3
- TI-2021-14727 Apache Ant TAR archive denial of service vulnerability CVSS 3.1MEDIUM 5.5
Sources
- CVE-2021-36374 · CVE Program
- CVE-2021-36374 · NVD
- FIRST EPSS
- GHSA-5v34-g2px-j4fw · GitHub Advisory Database · CC BY 4.0
- CVE-2021-36374 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences