VYPR
← All advisories
Moderate severityNVD Advisory· Published Sep 14, 2023· Updated Feb 13, 2025

Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file

CVE-2023-42503

Description

Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0.

Users are recommended to upgrade to version 1.24.0, which fixes the issue.

A third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption.

In version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example “1647221103.5998539”). The impacted fields are “atime”, “ctime”, “mtime” and “LIBARCHIVE.creationtime”. No input validation is performed prior to the parsing of header values.

Parsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as “9e9999999”) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5].

[1]: https://issues.apache.org/jira/browse/COMPRESS-612 [2]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 [3]: https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html [4]: https://bugs.openjdk.org/browse/JDK-6560193 [5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098

Only applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Malformed TAR file headers cause DoS via CPU exhaustion in Apache Commons Compress versions 1.22 to 1.23.

Vulnerability

Overview

CVE-2023-42503 is an improper input validation and uncontrolled resource consumption vulnerability in Apache Commons Compress, specifically in its TAR parsing functionality. The issue affects versions from 1.22 up to (but not including) 1.24.0. A remote attacker can craft a malformed TAR file with manipulated PAX extended headers for file modification times (such as atime, ctime, mtime, or LIBARCHIVE.creationtime) that lack input validation. Parsing these values uses the Java BigDecimal class, which exhibits known algorithmic complexity issues (JDK-6560193) when handling numbers with very long fractional parts (e.g., 300,000 digits) or exponent notation like 9e9999999, causing CPU exhaustion [1][2].

Exploitation

Details

The attack vector involves a third party supplying a specially crafted TAR file to an application that uses Apache Commons Compress's CompressorStreamFactory with auto-detection or directly invokes TAR archive parsing. No authentication is required beyond the ability to provide such a file (e.g., upload, network share, or email attachment). The parsing of the malicious header consumes excessive CPU resources, effectively causing a Denial of Service (DoS) by making the processing time escalate from seconds to hours [1][2].

Impact

Successful exploitation results in a denial of service via exhaustion of CPU resources. This can degrade or halt the affected application or service, leading to performance degradation or complete unavailability. The issue is similar to CVE-2012-2098, which also involved algorithmic complexity in number parsing [1].

Mitigation

The fix is implemented in Apache Commons Compress version 1.24.0, released on September 14, 2023. Users are strongly advised to upgrade to this version. The commit aae38bfb820159ae7a0b792e779571f6a46b3889 details the patch [2]. No workarounds other than upgrading are mentioned in the advisories. The library source code is available on GitHub [3].

References
  1. NVD - CVE-2023-42503
  2. Update site for CVE-2023-42503 · apache/commons-compress@aae38bf
  3. GitHub - apache/commons-compress: Apache Commons Compress

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.commons:commons-compressMaven
>= 1.22, < 1.24.01.24.0

Affected products

220

Patches

1
aae38bfb8201

Update site for CVE-2023-42503

https://github.com/apache/commons-compressGary GregorySep 13, 2023via ghsa
commit
1 file changed · +30 −0
  • src/site/xdoc/security.xml+30 −0 modified
    @@ -54,6 +54,36 @@
         the descriptions here are incomplete, please report them
         privately to the Apache Security Team. Thank you.</p>
 
+        <subsection name="Fixed in Apache Commons Compress 1.24.0">
+          <p><b>Moderate: Denial of Service</b> <a
+          href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42503">CVE-2023-42503</a></p>
+          
+          <p>Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.</p>
+          <p>This issue affects Apache Commons Compress: from 1.22 before 1.24.0.</p>
+          <p>Users are recommended to upgrade to version 1.24.0, which fixes the issue.</p>
+          <p>A third party can create a malformed TAR file by manipulating file modification times headers, 
+             which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption.</p>
+          <p>In version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision 
+             (issue # COMPRESS-612<sup><a href="#Ref-1-24-1">[1]</a></sup>).
+             The format for the PAX extended headers carrying this data consists of two numbers separated by a period<sup><a href="#Ref-1-24-2">[2]</a></sup>, 
+             indicating seconds and subsecond precision (for example “1647221103.5998539”). The impacted fields are “atime”, “ctime”, “mtime” and 
+             “LIBARCHIVE.creationtime”. No input validation is performed prior to the parsing of header values.</p>
+          <p>Parsing of these numbers uses the BigDecimal<sup><a href="#Ref-1-24-3">[3]</a></sup> class from the JDK which has a publicly known algorithmic complexity issue when doing 
+             operations on large numbers, causing denial of service (see issue # JDK-6560193<sup><a href="#Ref-1-24-4">[4]</a></sup>). A third party can manipulate file time headers 
+             in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as “9e9999999”) 
+             within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a 
+             denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098<sup><a href="#Ref-1-24-5">[5]</a></sup>.</p>
+          <ul>
+            <li id="Ref-1-24-1">[1]: <a href="https://issues.apache.org/jira/browse/COMPRESS-612">COMPRESS-612</a></li>
+            <li id="Ref-1-24-2">[2]: <a href="https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05">PAX extended headers</a></li>
+            <li id="Ref-1-24-3">[3]: <a href="https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html">BigDecimal</a></li>
+            <li id="Ref-1-24-4">[4]: <a href="https://bugs.openjdk.org/browse/JDK-6560193">JDK-6560193</a></li>
+            <li id="Ref-1-24-5">[5]: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098">CVE-2012-2098</a></li>
+          </ul>
+          <p>Only applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile 
+             classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.</p>
+        </subsection>
+
         <subsection name="Fixed in Apache Commons Compress 1.21">
           <p><b>Low: Denial of Service</b> <a
           href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35515">CVE-2021-35515</a></p>

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.