CVE-2021-35516
Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
- Record
CVE-2021-35516- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-130, CWE-770
- Updated
- 2026-11-02
CVE List No score
Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
- Record
CVE-2021-35516- Weakness
- CWE-130
- Updated
- 2026-11-02
EUVDEUVD-2021-1684 No score
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
- Record
EUVD-2021-1684- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-crv7-7245-f45f
Improper Handling of Length Parameter Inconsistency in Compress
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
- Record
GHSA-crv7-7245-f45f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-130, CWE-770
- Updated
- 2026-11-02
OSVAZL-45144
CVE-2021-35516 affecting package apache-commons-compress 1.19-3
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
- Record
AZL-45144- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSV
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
- Record
CVE-2021-35516- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2021-35516
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
- Record
DEBIAN-CVE-2021-35516- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-crv7-7245-f45f
Improper Handling of Length Parameter Inconsistency in Compress
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
- Record
GHSA-crv7-7245-f45f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-130, CWE-770
- Updated
- 2026-11-02
OSVOESA-2021-1302
apache-commons-compress security update
The Apache Commons Compress library defines an API for working with ar, cpio, Unix dump, tar, zip, gzip, XZ, Pack200 and bzip2 files.
Security Fix(es):
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.(CVE-2021-35517)
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.(CVE-2021-35516)
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.(CVE-2021-35515)
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.(CVE-2021-36090)
- Record
OESA-2021-1302- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2022:5555
Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update
- Record
RHSA-2022:5555- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-35516
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
- Record
UBUNTU-CVE-2021-35516- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1764806869 No score
TuxCare security update for org.apache.commons:commons-compress (5 CVEs)
TuxCare rebuilt org.apache.commons:commons-compress to address 5 CVEs. Fixed in 1.20-tuxcare.1.
- Record
CLSA-2025-1764806869- Updated
- 2026-11-02
OSVCLSA-2026-1770941373 No score
TuxCare security update for org.apache.commons:commons-compress (4 CVEs)
TuxCare rebuilt org.apache.commons:commons-compress to address 4 CVEs. Fixed in 1.19-tuxcare.2.
- Record
CLSA-2026-1770941373- Updated
- 2026-11-02
OSVMGASA-2022-0009 No score
Updated osgi-core/apache-commons-compress packages fix security vulnerability
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package. (CVE-2021-35515) When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package. (CVE-2021-35516) When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package. (CVE-2021-35517) When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package. (CVE-2021-36090)
- Record
MGASA-2022-0009- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1115-1 No score
Security update for apache-commons-compress
This update for apache-commons-compress fixes the following issues:
- Updated to 1.21
- CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. (bsc#1188463)
- CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. (bsc#1188464)
- CVE-2021-35517: Fixed an excessive memory allocation when reading a specially crafted TAR archive. (bsc#1188465)
- CVE-2021-36090: Fixed an excessive memory allocation when reading a specially crafted ZIP archive. (bsc#1188466)
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:1115-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2612-1 No score
Security update for apache-commons-compress
This update for apache-commons-compress fixes the following issues:
- Updated to 1.21
- CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. (bsc#1188463)
- CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. (bsc#1188464)
- CVE-2021-35517: Fixed an excessive memory allocation when reading a specially crafted TAR archive. (bsc#1188465)
- CVE-2021-36090: Fixed an excessive memory allocation when reading a specially crafted ZIP archive. (bsc#1188466)
- Record
openSUSE-SU-2021:2612-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10618-1 No score
apache-commons-compress-1.21-1.2 on GA media
These are all security issues fixed in the apache-commons-compress-1.21-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10618-1- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2021-35516 No score
CVE-2021-35516 in io.root.org.apache.commons:commons-compress - Patched by Root
Root has patched CVE-2021-35516 in the io.root.org.apache.commons:commons-compress package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2021-35516- Updated
- 2026-11-02
OSVSUSE-SU-2021:2612-1 No score
Security update for apache-commons-compress
This update for apache-commons-compress fixes the following issues:
- Updated to 1.21
- CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. (bsc#1188463)
- CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. (bsc#1188464)
- CVE-2021-35517: Fixed an excessive memory allocation when reading a specially crafted TAR archive. (bsc#1188465)
- CVE-2021-36090: Fixed an excessive memory allocation when reading a specially crafted ZIP archive. (bsc#1188466)
- Record
SUSE-SU-2021:2612-1- Updated
- 2026-11-02
Affected products
- apache commons compress
- apache software foundation commons compress
- netapp active iq unified manager
- netapp oncommand insight
- oracle banking digital experience
- oracle banking enterprise default management
- oracle banking party management
- oracle business process management suite
- oracle commerce guided search
- oracle communications billing and revenue management
- oracle communications cloud native core automated test suite
- oracle communications cloud native core service communication proxy
Show 13 moreShow less
- oracle communications cloud native core unified data repository
- oracle communications diameter intelligence hub
- oracle communications messaging server
- oracle communications session route manager
- oracle financial services crime and compliance management studio
- oracle financial services enterprise case management
- oracle flexcube universal banking
- oracle healthcare data repository
- oracle insurance policy administration
- oracle peoplesoft enterprise peopletools
- oracle primavera unifier
- oracle utilities testing accelerator
- oracle webcenter portal
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.commons:commons-compressMaven |
before 1.21 | 1.21 |
apache-commons-compressAzure Linux:3 |
through 1.19-3 | None known |
org.apache.commons:commons-compressTuxCare:Maven From an advisory covering 5 CVEs |
1.20 up to 1.20-tuxcare.1 | 1.20-tuxcare.1 |
org.apache.commons:commons-compressTuxCare:Maven From an advisory covering 4 CVEs |
1.19 up to 1.19-tuxcare.2, plus listed versions 1.19-tuxcare.1 |
1.19-tuxcare.2 |
libcommons-compress-javaDebian:12 |
before 1.21-1 | 1.21-1 |
libcommons-compress-javaDebian:13 |
before 1.21-1 | 1.21-1 |
libcommons-compress-javaDebian:14 |
before 1.21-1 | 1.21-1 |
org.apache.commons:commons-compressMaven |
before 1.21, plus listed versions 1.01.11.101.111.12 Show 19 moreShow less1.131.141.151.161.16.11.171.181.191.21.201.31.41.4.11.51.61.71.81.8.11.9 |
1.21 |
osgi-coreMageia:8 From an advisory covering 4 CVEs |
before 8.0.0-1.mga8 | 8.0.0-1.mga8 |
apache-commons-compressMageia:8 From an advisory covering 4 CVEs |
before 1.21-1.mga8 | 1.21-1.mga8 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
apache-commons-compressopenEuler:20.03-LTS-SP1 From an advisory covering 4 CVEs |
before 1.21-1.oe1 | 1.21-1.oe1 |
apache-commons-compressopenEuler:20.03-LTS-SP2 From an advisory covering 4 CVEs |
before 1.21-1.oe1 | 1.21-1.oe1 |
ovirt-web-uiRed Hat:rhev_manager:4.4:el8 From an advisory covering 9 CVEs |
before 0:1.9.0-1.el8ev | 0:1.9.0-1.el8ev |
ovirt-dependenciesRed Hat:rhev_manager:4.4:el8 From an advisory covering 9 CVEs |
before 0:4.5.2-1.el8ev | 0:4.5.2-1.el8ev |
apache-commons-compressRed Hat:rhev_manager:4.4:el8 From an advisory covering 9 CVEs |
before 0:1.21-1.2.el8ev | 0:1.21-1.2.el8ev |
apache-commons-compress-javadocRed Hat:rhev_manager:4.4:el8 From an advisory covering 9 CVEs |
before 0:1.21-1.2.el8ev | 0:1.21-1.2.el8ev |
io.root.org.apache.commons:commons-compressRoot:Maven |
before 1.21-root.io.1 | 1.21-root.io.11.21-root.io.2 |
org.apache.commons:commons-compressRoot:Maven |
before 1.21-aikido.2 | 1.21-aikido.2 |
apache-commons-compressSUSE:Linux Enterprise Module for Development Tools 15 SP2 From an advisory covering 4 CVEs |
before 1.21-3.3.1 | 1.21-3.3.1 |
apache-commons-compressSUSE:Linux Enterprise Module for Development Tools 15 SP3 From an advisory covering 4 CVEs |
before 1.21-3.3.1 | 1.21-3.3.1 |
libcommons-compress-javaUbuntu:16.04:LTS |
All versions, plus listed versions 1.9-11.10-11.10-2 |
None known |
libcommons-compress-javaUbuntu:18.04:LTS |
All versions, plus listed versions 1.13-11.13-21.18-1~18.04 |
None known |
libcommons-compress-javaUbuntu:20.04:LTS |
All versions, plus listed versions 1.18-31.19-1 |
None known |
libcommons-compress-javaUbuntu:22.04:LTS |
All versions, plus listed versions 1.20-11.21-1 |
None known |
libcommons-compress-javaUbuntu:24.04:LTS |
All versions, plus listed versions 1.23.0-11.24.0-11.25.0-1 |
None known |
libcommons-compress-javaUbuntu:25.10 |
All versions, plus listed versions 1.27.1-2 |
None known |
libcommons-compress-javaUbuntu:26.10 |
All versions, plus listed versions 1.27.1-2 |
None known |
libcommons-compress-javaUbuntu:26.04:LTS |
All versions, plus listed versions 1.27.1-2 |
None known |
apache-commons-compressopenSUSE:Leap 15.2 From an advisory covering 4 CVEs |
before 1.21-lp152.2.3.1 | 1.21-lp152.2.3.1 |
apache-commons-compressopenSUSE:Leap 15.3 From an advisory covering 4 CVEs |
before 1.21-3.3.1 | 1.21-3.3.1 |
apache-commons-compressopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 1.21-1.2 | 1.21-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-35516 is a high vulnerability (CVSS 7.5) in Apache Commons Compress, published July 13, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.4%, the 96th percentile. Fixed in org.apache.commons:commons-compress 1.21.
References
commons.apache.org/proper/commons-compress/security-reports.html
lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3E
openwall.com/lists/oss-security/2021/07/13/2
Show 109 moreShow less
oracle.com/security-alerts/cpuoct2021.html
security.netapp.com/advisory/ntap-20211022-0001
nvd.nist.gov/vuln/detail/CVE-2021-35516
github.com/advisories/GHSA-crv7-7245-f45f
security-tracker.debian.org/tracker/CVE-2021-35516
advisories.mageia.org/MGASA-2022-0009.html
bugs.mageia.org/show_bug.cgi?id=29254
lists.opensuse.org/archives/list/[email protected]/thread/XVOH7P2WI6SSS2OORQJBS45T5SKKO7BV
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1302
access.redhat.com/errata/RHSA-2022:5555
bugzilla.redhat.com/show_bug.cgi?id=1663217
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5555.json
cve.org/CVERecord?id=CVE-2021-3807
huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
suse.com/support/update/announcement/2021/suse-su-20212612-1
bugzilla.suse.com/1188463
ubuntu.com/security/CVE-2021-35516