VYPR
← All advisories
High severityNVD Advisory· Published Aug 29, 2019· Updated Aug 4, 2024

CVE-2019-12402

CVE-2019-12402

Description

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Commons Compress 1.15-1.18 file name encoding algorithm can enter infinite loop via crafted archive names, enabling denial of service.

Vulnerability

Apache Commons Compress versions 1.15 through 1.18 contain a vulnerability in the file name encoding algorithm used internally. When processing specially crafted inputs, the algorithm can enter an infinite loop [1]. This bug resides in the encoding logic for archive file names.

Exploitation

An attacker can exploit this by providing a malicious archive with crafted file names to an application using the vulnerable Compress library. No authentication is required; the attack can be triggered simply by parsing the archive [1].

Impact

Successful exploitation leads to a denial of service condition, as the infinite loop consumes CPU resources indefinitely, potentially causing the application to hang or crash.

Mitigation

The issue is fixed in Apache Commons Compress versions 1.19 and later. Users should upgrade to a patched version. The vulnerability has been addressed in the commons-compress project [1].

References
  1. NVD - CVE-2019-12402

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.commons:commons-compressMaven
>= 1.15, < 1.191.19

Affected products

4

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

55

News mentions

0

No linked articles in our index yet.