What’s Vulnerable › Vulnerabilities
CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 12.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-07-13 · updated 2026-10-08
- Weakness: CWE-130
Description
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
Affected products
- Apache Software Foundation Apache Commons Compress: from 1.0 before 1.21 — fixed in 1.21
- Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
- OnCommand Insight: all versions
- Oracle Banking Apis: from 18.1 through 18.3; 19.1, 19.2, 20.1, 21.1
- Oracle Corporation Banking Digital Experience: from 18.1 through 18.3; 19.1, 19.2, 20.1, 21.1
- Oracle Banking Enterprise Default Management: 2.7.0
- Oracle Banking Party Management: 2.7.0
- Oracle Corporation Banking Payments: 14.5
- Oracle Banking Platform: 2.6.2, 2.7.1, 2.9.0, 2.12.0
- Oracle Corporation Banking Trade Finance: 14.5
- Oracle Corporation Banking Treasury Management: 14.5
- Oracle Corporation Oracle Business Process Management Suite: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Corporation Communications Billing and Revenue Management: 12.0.0.4
- Oracle Communications Cloud Native Core Automated Test Suite: 1.8.0
- Oracle Communications Cloud Native Core Service Communication Proxy: 1.14.0
- Oracle Communications Cloud Native Core Unified Data Repository: 1.14.0
- Oracle Communications Diameter Intelligence Hub: from 8.0.0 through 8.2.3; 8.2.3
- Oracle Communications Element Manager: from 8.2.0 through 8.2.4.0
- Oracle Communications Messaging Server: 8.1
- Oracle Communications Session Report Manager: from 8.2.0 through 8.2.5.0
- Oracle Communications Session Route Manager: from 8.0.0 through 8.2.5.0
- Oracle Corporation Oracle Communications Unified Inventory Management: 7.4.0, 7.4.1, 7.4.2, 7.5.0
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.1.1
- Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
- Oracle Corporation Oracle Financial Services Enterprise Case Management: 8.0.7.2.0, 8.0.8.1.0
- Oracle Corporation FLEXCUBE Universal Banking: from 14.0.0 through 14.3.0; 12.4, 14.5
- Oracle Healthcare Data Repository: 8.1.0
- Oracle Insurance Policy Administration: 11.0.2, 11.1.0, 11.2.8, 11.3.0, 11.3.1
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.57, 8.58, 8.59
How to fix
Upgrade to a fixed version: Apache Software Foundation Apache Commons Compress 1.21. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2021/07/13/4
- http://www.openwall.com/lists/oss-security/2021/07/13/6
- https://commons.apache.org/proper/commons-compress/security-reports.html
- https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd%40%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949%40%3Ccommits.drill.apache.org%3E
- https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E
- https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E
Get alerted when CVE-2021-36090 or the next vulnerability affects your stack