What’s Vulnerable › Vulnerabilities
CVE-2021-35515: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 11.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-07-13 · updated 2026-06-17
- Weakness: CWE-834
Description
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Affected products
- Apache Software Foundation Apache Commons Compress: from 1.6 through 1.20
- Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
- OnCommand Insight: all versions
- Oracle Corporation Banking Digital Experience: from 18.1 through 18.3; 19.1, 20.1, 21.1
- Oracle Banking Enterprise Default Management: 2.7.0
- Oracle Banking Party Management: 2.7.0
- Oracle Corporation Banking Payments: 14.5
- Oracle Corporation Banking Trade Finance: 14.5
- Oracle Corporation Banking Treasury Management: 14.5
- Oracle Corporation Oracle Business Process Management Suite: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Corporation Communications Billing and Revenue Management: 12.0.0.4
- Oracle Communications Cloud Native Core Automated Test Suite: 1.8.0
- Oracle Communications Cloud Native Core Service Communication Proxy: 1.14.0
- Oracle Communications Cloud Native Core Unified Data Repository: 1.14.0
- Oracle Communications Diameter Intelligence Hub: from 8.0.0 through 8.2.3
- Oracle Communications Messaging Server: 8.1
- Oracle Communications Session Route Manager: from 8.0.0 through 8.2.5
- Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
- Oracle Corporation Oracle Financial Services Enterprise Case Management: 8.0.7.2.0, 8.0.8.1.0
- Oracle Corporation FLEXCUBE Universal Banking: from 14.0.0 through 14.3.0; 12.4.0, 14.5.0
- Oracle Healthcare Data Repository: 8.1.0
- Oracle Insurance Policy Administration: 11.0.2, 11.1.0, 11.2.8, 11.3.0, 11.3.1
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.57, 8.58, 8.59
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 18.8, 19.12, 20.12
- Oracle Utilities Testing Accelerator: 6.0.0.1.1, 6.0.0.2.2, 6.0.0.3.1
References
- http://www.openwall.com/lists/oss-security/2021/07/13/1
- https://commons.apache.org/proper/commons-compress/security-reports.html
- https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E
- https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E
- https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rbaea15ddc5a7c0c6b66660f1d6403b28595e2561bb283eade7d7cd69%40%3Cannounce.apache.org%3E
Get alerted when CVE-2021-35515 or the next vulnerability affects your stack