VYPR
← All advisories
Moderate severityNVD Advisory· Published Feb 19, 2024· Updated Nov 4, 2025

Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

CVE-2024-25710

Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Infinite loop in Apache Commons Compress when processing a corrupt DUMP file leads to denial of service.

Vulnerability

CVE-2024-25710 is a loop with an unreachable exit condition ('infinite loop') vulnerability in Apache Commons Compress, affecting versions 1.3 through 1.25.0. The bug occurs when the library reads a specially crafted DUMP archive file, causing an infinite loop and resulting in a denial of service [1][3].

Exploitation

To exploit this vulnerability, an attacker must provide a malicious DUMP file that triggers the infinite loop. No authentication is required if the application accepts arbitrary archive files from untrusted sources. The attack vector is network-based if the compressed file is processed remotely, but local access may also be sufficient [3].

Impact

Successful exploitation leads to excessive CPU consumption and unresponsiveness of the application using the library, effectively causing a denial of service [3].

Mitigation

Users should upgrade to Apache Commons Compress version 1.26.0, which fixes the issue. No workarounds are documented [1].

References
  1. NVD - CVE-2024-25710
  2. security - CVE-2024-25710: Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.commons:commons-compressMaven
>= 1.3, < 1.26.01.26.0

Affected products

539

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.