CVE-2021-36090

Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

HIGH 7.5

En bref

Source: NVD
EPSS: EPSS 12.95 % · centile 96 (2026-10-28)
État: PUBLISHED
Publiée: 2021-07-13 07:15 UTC
Mise à jour: 2026-10-08 21:03 UTC
Attribuée par: apache
Statut NVD: Modified

Description

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Faiblesses (CWE)

CWE-130

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P	NVD · nvd@nist.gov (Primary)

Avis

GHSA-mc84-pj99-q6hh — Improper Handling of Length Parameter Inconsistency in Compress

Références européennes

ENISA EUVD · EUVD-2021-1798
GCVE · GCVE-0-2021-36090

Avis du CERT-FR

CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
CERTFR-2026-AVI-0556 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2025-AVI-0590 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0590 — Multiples vulnérabilités dans les produits Atlassian · cert.ssi.gouv.fr
CERTFR-2023-AVI-0325 — Multiples vulnérabilités dans les produits Oracle · cert.ssi.gouv.fr
CERTFR-2023-AVI-0073 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2022-AVI-523 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2022-AVI-239 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2021-AVI-943 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2021-AVI-932 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2021-AVI-804 — Multiples vulnérabilités dans Oracle PeopleSoft · cert.ssi.gouv.fr
CERTFR-2021-AVI-671 — Multiples vulnérabilités dans IBM Spectrum Protect Plus · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:* ≥ 1.0 < 1.21
cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:* ≥ 18.1 ≤ 18.3
cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* ≥ 18.1 ≤ 18.3
cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* ≥ 8.0.0 ≤ 8.2.3
cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* ≥ 8.2.0 ≤ 8.2.4.0
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* ≥ 8.2.0 ≤ 8.2.5.0
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* ≥ 8.0.0 ≤ 8.2.5.0
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* ≥ 8.0.6 ≤ 8.1.1
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_enterprise_case_management:*:*:*:*:*:*:*:*
+32 autres

Produits affectés

Produit	Versions
Apache Software Foundation · Apache Commons Compress	affected Apache Commons Compress ≤ 1.20

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD