Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-35516

Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Commons Compress

  • 1.6 to < Apache Commons Compress*affected

References