VYPR
← All advisories
High severityNVD Advisory· Published Jul 13, 2021· Updated Aug 4, 2024

Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

CVE-2021-36090

Description

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A specially crafted ZIP archive triggers excessive memory allocation in Apache Commons Compress (1.0–1.20) and Apache Ant, causing denial of service.

Vulnerability

An out-of-memory vulnerability exists in the Apache Commons Compress library (versions 1.0 to 1.20) and in Apache Ant (1.9.x before 1.9.16, 1.10.x before 1.10.11). When reading a specially crafted ZIP archive (or derived formats such as JAR files or office documents), the parser can be made to allocate large amounts of memory, leading to an OutOfMemoryError even for very small input files [1] [2] [3].

Exploitation

The attacker needs only the ability to supply a malicious ZIP archive to an application that uses Compress's ZIP package or Apache Ant's ZIP-based archive handling. No authentication or special privileges are required; the attack can be launched by uploading or including a crafted archive. The vulnerability is triggered automatically when the file is read or processed [1] [3].

Impact

Successful exploitation results in a denial of service (DoS) condition. The affected application (service, build process, etc.) exhausts available memory, causing it to crash or become unresponsive. The impact is limited to availability; no data confidentiality or integrity is compromised [1] [2].

Mitigation

Upgrade to a fixed version: Apache Commons Compress 1.21 or later [3]; Apache Ant 1.9.16 or later, or 1.10.11 or later [2]. No workarounds are provided in the available references [1] [2] [3].

References
  1. NVD - CVE-2021-36090
  2. security - CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability
  3. security - CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.commons:commons-compressMaven
< 1.211.21

Affected products

7

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

62

News mentions

0

No linked articles in our index yet.