CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-14 · updated 2026-08-25
Weakness: CWE-130

Description

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Affected products

Apache Software Foundation Apache Ant: from 1.9.0 before 1.9.16; from 1.10.0 before 1.10.11 — fixed in 1.10.11, 1.9.16
Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
Oracle Corporation Oracle Agile PLM: 9.3.6
Oracle Corporation Banking Trade Finance: 14.5
Oracle Corporation Banking Treasury Management: 14.5
Oracle Communications Cloud Native Core Automated Test Suite: 1.9.0
Oracle Communications Cloud Native Core Binding Support Function: 1.11.0
Oracle Communications Diameter Intelligence Hub: from 8.0.0 through 8.1.0; from 8.2.0 through 8.2.3
Oracle Corporation Oracle Communications Order and Service Management: 7.3, 7.4
Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.0, 7.4.0, 7.4.1, 7.4.2, 7.5.0
Oracle Corporation Enterprise Repository: 11.1.1.7.0
Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.1.1
Oracle Health Sciences Information Manager: from 3.0.1 through 3.0.5; 3.0.0.1
Oracle Insurance Policy Administration: from 11.0 through 11.3.1
Oracle Corporation Primavera Gateway: from 17.12.0 through 17.12.11; from 18.8.0 through 18.8.12; from 19.12.0 through 19.12.11; from 20.12.0 through 20.12.7
Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 18.8, 19.12, 20.12
Oracle Corporation Oracle Product Lifecycle Analytics: 3.6.1
Oracle Real-Time Decision Server: 3.2.0.0, 11.1.1.9.0
Oracle Retail Advanced Inventory Planning: 14.1, 15.0, 16.0
Oracle Corporation Retail Back Office: 14.0, 14.1
Oracle Corporation Retail Bulk Data Integration: 16.0.3.0, 19.0.1
Oracle Corporation Retail Central Office: 14.0, 14.1
Oracle Corporation Oracle Retail EFTLink: 19.0.1, 20.0.1
Oracle Retail Extract Transform And Load: 13.2.8
Oracle Retail Financial Integration: 14.1.3.2, 15.0.4.0, 16.0.3.0
Oracle Corporation Oracle Retail Integration Bus: 14.1.3.2, 15.0.4.0, 16.0.3.0, 19.0.1.0
Oracle Corporation Retail Invoice Matching: 16.0.3
Oracle Corporation Retail Merchandising System: 19.0.1
Oracle Corporation Retail Point-of-Service: 14.0, 14.1
Oracle Retail Predictive Application Server: 14.1.3, 15.0.3, 16.0.3.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Ant 1.10.11, 1.9.16; Oracle Corporation TimesTen In-Memory Database 11.2.2.8.27. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-36374 or the next vulnerability affects your stack