CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-14 · updated 2026-08-25
Weakness: CWE-130

Description

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Affected products

Apache Software Foundation Apache Ant: from 1.9.0 before 1.9.16; from 1.10.0 before 1.10.11 — fixed in 1.10.11, 1.9.16
Oracle Corporation Oracle Agile PLM: 9.3.6
Oracle Corporation Banking Trade Finance: 14.5
Oracle Corporation Banking Treasury Management: 14.5
Oracle Communications Cloud Native Core Automated Test Suite: 1.9.0
Oracle Communications Cloud Native Core Binding Support Function: 1.11.0
Oracle Corporation Oracle Communications Order and Service Management: 7.3, 7.4
Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.0, 7.4.0, 7.4.1, 7.4.2, 7.5.0
Oracle Corporation Enterprise Repository: 11.1.1.7.0
Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.1.1
Oracle Insurance Policy Administration: from 11.0 through 11.3.1
Oracle Corporation Primavera Gateway: from 17.12.0 through 17.12.11; from 18.8.0 through 18.8.12; from 19.12.0 through 19.12.11; from 20.12.0 through 20.12.7
Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 18.8, 19.12, 20.12
Oracle Real-Time Decision Server: 3.2.0.0, 11.1.1.9.0
Oracle Retail Advanced Inventory Planning: 14.1, 15.0, 16.0
Oracle Corporation Retail Back Office: 14.0, 14.1
Oracle Corporation Retail Bulk Data Integration: 16.0.3.0, 19.0.1
Oracle Corporation Retail Central Office: 14.0, 14.1
Oracle Corporation Oracle Retail EFTLink: 19.0.1, 20.0.1
Oracle Retail Extract Transform And Load: 13.2.8
Oracle Retail Financial Integration: 14.1.3.2, 15.0.4.0, 16.0.3.0
Oracle Corporation Oracle Retail Integration Bus: 14.1.3.2, 15.0.4.0, 16.0.3.0, 19.0.1.0
Oracle Corporation Retail Invoice Matching: 16.0.3
Oracle Corporation Retail Merchandising System: 19.0.1
Oracle Corporation Retail Point-of-Service: 14.0, 14.1
Oracle Retail Predictive Application Server: 14.1.3, 15.0.3, 16.0.3.0
Oracle Retail Service Backbone: 14.1.3.2, 15.0.4.0, 16.0.3.0, 19.0.1.0
Oracle Corporation Retail Store Inventory Management: 14.1, 15.0, 16.0
Oracle Corporation Retail Xstore Point of Service: 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1
Oracle Corporation TimesTen In-Memory Database: before 11.2.2.8.27 — fixed in 11.2.2.8.27

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Ant 1.10.11, 1.9.16; Oracle Corporation TimesTen In-Memory Database 11.2.2.8.27. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-36373 or the next vulnerability affects your stack