Medium severity5.5NVD Advisory· Published Jul 14, 2021· Updated Aug 25, 2026

CVE-2021-36373

Description

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.ant:antMaven	< 1.9.16	1.9.16
org.apache.ant:antMaven	>= 1.10.0, < 1.10.11	1.10.11

Affected products

Apache/Ant
cpe:2.3:a:apache:ant:*:*:*:*:*:*:*:*
Range: >=1.9.0,<1.9.16
Oracle Corporation/Agile Plm
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Oracle Corporation/Banking Trade Finance
cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:*
Oracle Corporation/Banking Treasury Management
cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Automated Test Suite
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Binding Support Function
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Order And Service Management2 versions
cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_order_and_service_management:7.4:*:*:*:*:*:*:*
Oracle Corporation/Communications Unified Inventory Management5 versions
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:*
Oracle Corporation/Enterprise Repository
cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*
Oracle Corporation/Financial Services Analytical Applications Infrastructure
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
Range: >=8.0.6,<=8.1.1
Oracle Corporation/Insurance Policy Administration
cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*
Range: >=11.0,<=11.3.1
Oracle Corporation/Primavera Gateway
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
Range: >=17.12.0,<=17.12.11
Oracle Corporation/Primavera Unifier4 versions
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*range: >=17.7,<=17.12
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*
Oracle Corporation/Real Time Decision Server2 versions
cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:real-time_decision_server:11.1.1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Advanced Inventory Planning3 versions
cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_advanced_inventory_planning:16.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Back Office2 versions
cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Bulk Data Integration2 versions
cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_bulk_data_integration:19.0.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Central Office2 versions
cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Eftlink2 versions
cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Extract Transform And Load
cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:*:*:*:*:*:*:*
Oracle Corporation/Retail Financial Integration3 versions
cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_financial_integration:15.0.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_financial_integration:16.0.3.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Integration Bus4 versions
cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:15.0.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:16.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:19.0.1.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Invoice Matching
cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:*:*:*:*:*:*:*
Oracle Corporation/Retail Merchandising System
cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Point Of Service2 versions
cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Predictive Application Server3 versions
cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Service Backbone4 versions
cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_service_backbone:15.0.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_service_backbone:16.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_service_backbone:19.0.1.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Store Inventory Management3 versions
cpe:2.3:a:oracle:retail_store_inventory_management:14.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_store_inventory_management:14.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_store_inventory_management:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_store_inventory_management:16.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Xstore Point Of Service5 versions
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*
Oracle Corporation/Timesten In Memory Database
cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:*
Range: <11.2.2.8.27
Oracle Corporation/Utilities Framework6 versions
cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*range: >=4.3.0.1.0,<=4.3.0.6.0
- cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*
Oracle Corporation/Utilities Testing Accelerator
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*
ghsa-coords20 versions
pkg:maven/org.apache.ant/ant pkg:rpm/opensuse/ant&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/ant&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/ant&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/ant-antlr&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/ant-antlr&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/ant-junit&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/ant-junit&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/ant-junit5&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/ant-junit5&distro=openSUSE%20Leap%2015.4 pkg:rpm/suse/ant&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP3 pkg:rpm/suse/ant&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP2 pkg:rpm/suse/ant&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/ant&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/ant&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/ant-antlr&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP3 pkg:rpm/suse/ant-antlr&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP2 pkg:rpm/suse/ant-antlr&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/ant-junit&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP3 pkg:rpm/suse/ant-junit&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP2
< 1.9.16+ 19 more
- (no CPE)range: < 1.9.16
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.10.12-1.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.9.4-3.9.1
- (no CPE)range: < 1.9.4-3.9.1
- (no CPE)range: < 1.9.4-3.9.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.9.4-3.9.1
- (no CPE)range: < 1.10.7-150200.4.6.1
- (no CPE)range: < 1.10.7-150200.4.6.1
Apache/Apachecpe-rescue
Range: Apache Ant 1.9.x

Patches

Vulnerability mechanics

References

ant.apache.org/security.htmlnvdPatchVendor AdvisoryWEB
www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2022.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-q5r4-cfpx-h6fhghsaADVISORY
lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3EnvdMailing ListVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2021-36373ghsaADVISORY
security.netapp.com/advisory/ntap-20210819-0007/nvdThird Party Advisory
lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a@%3Ccommits.groovy.apache.org%3EghsaWEB
lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d@%3Ccommits.groovy.apache.org%3EghsaWEB
lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a@%3Cnotifications.groovy.apache.org%3EghsaWEB
lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6@%3Cdev.myfaces.apache.org%3EghsaWEB
security.netapp.com/advisory/ntap-20210819-0007ghsaWEB
www.oracle.com/security-alerts/cpujul2022.htmlnvdNot ApplicableWEB
lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3Envd
lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3Envd
lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a%40%3Cnotifications.groovy.apache.org%3Envd
lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6%40%3Cdev.myfaces.apache.org%3Envd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000