VYPR
← All advisories
High severityNVD Advisory· Published Jul 13, 2021· Updated Aug 4, 2024

Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

CVE-2021-35515

Description

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Commons Compress 1.6 to 1.20 has an infinite loop when reading a crafted 7Z archive, causing denial of service.

Vulnerability

Apache Commons Compress versions 1.6 through 1.20 are affected by an infinite loop vulnerability when reading a specially crafted 7Z archive. During the construction of the list of codecs that decompress an entry, the code can enter an infinite loop, leading to a denial of service [1][2].

Exploitation

An attacker can exploit this by providing a crafted 7Z archive to a service that uses the Compress library's sevenz package. No authentication is required; the attacker only needs to supply the malicious archive, which can be done remotely if the service accepts user-submitted archives. The infinite loop occurs during parsing, causing the application to hang indefinitely [2].

Impact

Successful exploitation results in a denial of service (DoS) condition, making the affected service unavailable. The impact is limited to availability, with no confidentiality or integrity compromise [1][2].

Mitigation

The issue is fixed in Apache Commons Compress version 1.21 [2]. Users should upgrade to 1.21 or later. There is no known workaround for earlier versions. The vulnerability was discovered by OSS Fuzz and is considered low severity [2].

References
  1. NVD - CVE-2021-35515
  2. security - CVE-2021-35515: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.commons:commons-compressMaven
< 1.211.21

Affected products

7

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

37

News mentions

0

No linked articles in our index yet.