Apache Software Foundation Apache Commons Compress
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-25710 | 1.3 – 1.25.0 | Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file | HIGH 8.1 | 0.4 % | ||
| CVE-2024-26308 | 1.21 – < 1.26.0 | Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file | MEDIUM 5.5 | 0.9 % | ||
| CVE-2023-42503 | 1.22 – < 1.24.0 | Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file | MEDIUM 5.5 | 0.6 % | ||
| CVE-2021-36090 | Apache Commons Compress – 1.20 | Apache Commons Compress 1.0 to 1.20 denial of service vulnerability | HIGH 7.5 | 13 % | ||
| CVE-2021-35517 | 1.1 – < Apache Commons Compress* | Apache Commons Compress 1.1 to 1.20 denial of service vulnerability | HIGH 7.5 | 11 % | ||
| CVE-2021-35516 | 1.6 – < Apache Commons Compress* | Apache Commons Compress 1.6 to 1.20 denial of service vulnerability | HIGH 7.5 | 12 % | ||
| CVE-2021-35515 | 1.6 – < Apache Commons Compress* | Apache Commons Compress 1.6 to 1.20 denial of service vulnerability | HIGH 7.5 | 12 % | ||
| CVE-2019-12402 | 1.15 to 1.18 | The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with speci | HIGH 7.5 | 16 % | ||
| CVE-2018-11771 | 1.7 to 1.17 | When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to ret | MEDIUM 5.5 | 5.3 % | ||
| CVE-2018-1324 | 1.11 to 1.15 | A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipF | MEDIUM 5.5 | 3.7 % |