CVE-2012-2098
Uncontrolled Resource Consumption in Apache Commons Compress
CVE-2012-2098 is a medium vulnerability (CVSS 5.0) in Apache Commons Compress, published June 29, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.8%, the 96th percentile. Fixed in org.apache.commons:commons-compress 1.4.1.
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
Exploit likelihood
What each source reports
NVD Score used
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
- Record
CVE-2012-2098- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
- Record
CVE-2012-2098- Updated
- 2026-11-02
EUVDEUVD-2022-2784 No score
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
- Record
EUVD-2022-2784- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6fxm-66hq-fc96 No score
Uncontrolled Resource Consumption in Apache Commons Compress
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
- Record
GHSA-6fxm-66hq-fc96- Weakness
- CWE-400
- Updated
- 2026-11-02
OSV No score
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
- Record
CVE-2012-2098- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2098 No score
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
- Record
DEBIAN-CVE-2012-2098- Updated
- 2026-11-02
OSVGHSA-6fxm-66hq-fc96 No score
Uncontrolled Resource Consumption in Apache Commons Compress
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
- Record
GHSA-6fxm-66hq-fc96- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVMGASA-2014-0056 No score
Updated plexus-archiver package fixes security vulnerability
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs (CVE-2012-2098).
plexus-archiver used an embedded copy of the affected code from Apache Commons Compress, and therefore was affected by this. It has been patched to use the apache-commons-compress package, in which this issue has already been fixed, for bzip2 compression and decompression.
- Record
MGASA-2014-0056- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.commons:commons-compressMaven |
before 1.4.1 | 1.4.1 |
libcommons-compress-javaDebian:12 |
before 1.4.1-1 | 1.4.1-1 |
libcommons-compress-javaDebian:13 |
before 1.4.1-1 | 1.4.1-1 |
libcommons-compress-javaDebian:14 |
before 1.4.1-1 | 1.4.1-1 |
org.apache.commons:commons-compressMaven |
before 1.4.1, plus listed versions 1.01.11.21.31.4 |
1.4.1 |
plexus-archiverMageia:3 |
before 2.3-1.1.mga3 | 2.3-1.1.mga3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.fedoraproject.org/pipermail/package-announce/2013-May/105060.html
exchange.xforce.ibmcloud.com/vulnerabilities/75857
archives.neohapsis.com/archives/bugtraq/2012-05/0130.html
osvdb.org/82161
securityfocus.com/bid/53676
Show 35 moreShow less
securitytracker.com/id?1027096
secunia.com/advisories/49255
lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
commons.apache.org/compress/security.html
www-01.ibm.com/support/docview.wss?uid=swg21644047
packetstormsecurity.org/files/113014/Apache-Commons-Compress-Apache-Ant-Denial-Of-Service.html
ant.apache.org/security.html
oracle.com/security-alerts/cpujan2021.html
openwall.com/lists/oss-security/2023/09/13/3
nvd.nist.gov/vuln/detail/CVE-2012-2098
web.archive.org/web/20130525085523/http://www.securityfocus.com/bid/53676
github.com/apache/commons-compress/commit/020c03d8ef579e80511023fb46ece30e9c3dd27d
security-tracker.debian.org/tracker/CVE-2012-2098
advisories.mageia.org/MGASA-2014-0056.html
bugs.mageia.org/show_bug.cgi?id=6331