What’s Vulnerable › Vulnerabilities
CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 10.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-07-13 · updated 2026-10-08
- Weakness: CWE-130
Description
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
Affected products
- Apache Software Foundation Apache Commons Compress: from 1.1 through 1.20
- Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
- OnCommand Insight: all versions
- Oracle Banking Apis: from 18.1 through 18.3; 19.1, 19.2, 20.1, 21.1
- Oracle Corporation Banking Digital Experience: from 18.1 through 18.3; 19.1, 19.2, 20.1, 21.1
- Oracle Banking Enterprise Default Management: 2.7.0
- Oracle Banking Party Management: 2.7.0
- Oracle Corporation Banking Payments: 14.5
- Oracle Corporation Banking Trade Finance: 14.5
- Oracle Corporation Banking Treasury Management: 14.5
- Oracle Corporation Oracle Business Process Management Suite: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Corporation Communications Billing and Revenue Management: 12.0.0.4
- Oracle Communications Cloud Native Core Service Communication Proxy: 1.14.0
- Oracle Communications Cloud Native Core Unified Data Repository: 1.14.0
- Oracle Communications Diameter Intelligence Hub: from 8.0.0 through 8.2.3
- Oracle Communications Messaging Server: 8.1
- Oracle Communications Session Route Manager: from 8.0.0 through 8.2.5
- Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
- Oracle Corporation Oracle Financial Services Enterprise Case Management: 8.0.7.2.0, 8.0.8.1.0
- Oracle Corporation FLEXCUBE Universal Banking: from 14.0.0 through 14.3.0; 12.4, 14.5
- Oracle Healthcare Data Repository: 8.1.0
- Oracle Insurance Policy Administration: 11.0.2, 11.1.0, 11.2.8, 11.3.0, 11.3.1
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.57, 8.58, 8.59
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 18.8, 19.12, 20.12
- Oracle Utilities Testing Accelerator: 6.0.0.1.1, 6.0.0.2.2, 6.0.0.3.1
- Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
References
- http://www.openwall.com/lists/oss-security/2021/07/13/3
- http://www.openwall.com/lists/oss-security/2021/07/13/5
- https://commons.apache.org/proper/commons-compress/security-reports.html
- https://lists.apache.org/thread.html/r31f75743ac173b0a606f8ea6ea53f351f386c44e7bcf78ae04007c29%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r457b2ed564860996b20d938566fe8bd4bfb7c37be8e205448ccb5975%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3E
- https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E
- https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E
- https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/ra393ffdc7c90a4a37ea023946f390285693795013a642d80fba20203%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E
Get alerted when CVE-2021-35517 or the next vulnerability affects your stack