VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 16, 2018· Updated Sep 17, 2024

CVE-2018-1324

CVE-2018-1324

Description

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Commons Compress 1.11 to 1.15 can be forced into an infinite loop via a specially crafted ZIP archive, enabling denial of service attacks.

Vulnerability

A specially crafted ZIP archive can trigger an infinite loop inside the extra field parser of ZipFile and ZipArchiveInputStream classes in Apache Commons Compress versions 1.11 through 1.15 [1]. The parser does not correctly handle malformed or corrupt extra field data, causing the loop to never terminate when processing the crafted archive [4].

Exploitation

An attacker needs only the ability to supply a malicious ZIP archive to a service that uses the affected ZipFile or ZipArchiveInputStream classes [1]. No authentication or special privileges are required. The attack is performed by sending the crafted archive to the target service; upon parsing, the infinite loop consumes CPU resources indefinitely, leading to a denial of service [4].

Impact

Successful exploitation results in a denial of service (CPU exhaustion) against any service using the affected Apache Commons Compress versions [1]. The infinite loop prevents the service from processing further requests, potentially causing availability loss for the entire application [4].

Mitigation

Upgrade to Apache Commons Compress version 1.16 or later, which fixes the infinite loop issue [1]. Users on version 1.11 to 1.15 should update immediately. No known workarounds exist for this vulnerability [4].

References
  1. NVD - CVE-2018-1324
  2. CVE-2018-1324 - GitHub Advisory Database

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.commons:commons-compressMaven
>= 1.11, < 1.161.16
com.liferay:com.liferay.portal.tools.bundle.supportMaven
>= 3.2.7, < 3.7.43.7.4

Affected products

4

Patches

1
2a2f1dc48e22

COMPRESS-432 make sure code doesn't get stuck in infinite loop

https://github.com/apache/commons-compressStefan BodewigDec 22, 2017via ghsa
commit
1 file changed · +1 −1
  • src/main/java/org/apache/commons/compress/archivers/zip/X0017_StrongEncryptionHeader.java+1 −1 modified
    @@ -310,7 +310,7 @@ public void parseCentralDirectoryFormat(final byte[] data, final int offset, fin
             this.hashAlg = HashAlgorithm.getAlgorithmByCode(ZipShort.getValue(data, offset + 12));
             this.hashSize = ZipShort.getValue(data, offset + 14);
             // srlist... hashed public keys
-            for (int i = 0; i < this.rcount; i++) {
+            for (long i = 0; i < this.rcount; i++) {
                 for (int j = 0; j < this.hashSize; j++) {
                     //  ZipUtil.signedByteToUnsignedInt(data[offset + 16 + (i * this.hashSize) + j]));
                 }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

16

News mentions

0

No linked articles in our index yet.