CVE-2021-36090
Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
- Record
CVE-2021-36090- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-130
- Updated
- 2026-11-02
CVE List No score
Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
- Record
CVE-2021-36090- Weakness
- CWE-130
- Updated
- 2026-11-02
EUVDEUVD-2021-1798 No score
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
- Record
EUVD-2021-1798- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mc84-pj99-q6hh
Improper Handling of Length Parameter Inconsistency in Compress
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
- Record
GHSA-mc84-pj99-q6hh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-130
- Updated
- 2026-11-02
OSVAZL-45411
CVE-2021-36090 affecting package apache-commons-compress 1.19-3
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
- Record
AZL-45411- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSV
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
- Record
CVE-2021-36090- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 14 moreShow less
OSVDEBIAN-CVE-2021-36090
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
- Record
DEBIAN-CVE-2021-36090- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-mc84-pj99-q6hh
Improper Handling of Length Parameter Inconsistency in Compress
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
- Record
GHSA-mc84-pj99-q6hh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-130
- Updated
- 2026-11-02
OSVOESA-2021-1302
apache-commons-compress security update
The Apache Commons Compress library defines an API for working with ar, cpio, Unix dump, tar, zip, gzip, XZ, Pack200 and bzip2 files.
Security Fix(es):
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.(CVE-2021-35517)
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.(CVE-2021-35516)
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.(CVE-2021-35515)
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.(CVE-2021-36090)
- Record
OESA-2021-1302- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-685154d7989c42e9
Lightwell Security Advisory: commons-compress 1.9.0.rhlw-00005
Red Hat Lightwell has released org.apache.commons:commons-compress 1.9.0.rhlw-00005 with backported fixes for CVE-2018-11771, CVE-2021-35515, CVE-2021-35517, CVE-2021-36090, and CVE-2024-25710.
CVE-2018-11771: When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.
CVE-2021-35515: When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
CVE-2021-35517: When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
CVE-2021-36090: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
CVE-2024-25710: Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
This patched artifact is a drop-in replacement for org.apache.commons:commons-compress 1.9.0 from Maven Central.
- Record
RHLW-2026-685154d7989c42e9- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2022:5555
Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update
- Record
RHSA-2022:5555- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-36090
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
- Record
UBUNTU-CVE-2021-36090- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1764806869 No score
TuxCare security update for org.apache.commons:commons-compress (5 CVEs)
TuxCare rebuilt org.apache.commons:commons-compress to address 5 CVEs. Fixed in 1.20-tuxcare.1.
- Record
CLSA-2025-1764806869- Updated
- 2026-11-02
OSVCLSA-2026-1770941373 No score
TuxCare security update for org.apache.commons:commons-compress (4 CVEs)
TuxCare rebuilt org.apache.commons:commons-compress to address 4 CVEs. Fixed in 1.19-tuxcare.2.
- Record
CLSA-2026-1770941373- Updated
- 2026-11-02
OSVMGASA-2022-0009 No score
Updated osgi-core/apache-commons-compress packages fix security vulnerability
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package. (CVE-2021-35515) When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package. (CVE-2021-35516) When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package. (CVE-2021-35517) When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package. (CVE-2021-36090)
- Record
MGASA-2022-0009- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1115-1 No score
Security update for apache-commons-compress
This update for apache-commons-compress fixes the following issues:
- Updated to 1.21
- CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. (bsc#1188463)
- CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. (bsc#1188464)
- CVE-2021-35517: Fixed an excessive memory allocation when reading a specially crafted TAR archive. (bsc#1188465)
- CVE-2021-36090: Fixed an excessive memory allocation when reading a specially crafted ZIP archive. (bsc#1188466)
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:1115-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2612-1 No score
Security update for apache-commons-compress
This update for apache-commons-compress fixes the following issues:
- Updated to 1.21
- CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. (bsc#1188463)
- CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. (bsc#1188464)
- CVE-2021-35517: Fixed an excessive memory allocation when reading a specially crafted TAR archive. (bsc#1188465)
- CVE-2021-36090: Fixed an excessive memory allocation when reading a specially crafted ZIP archive. (bsc#1188466)
- Record
openSUSE-SU-2021:2612-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10618-1 No score
apache-commons-compress-1.21-1.2 on GA media
These are all security issues fixed in the apache-commons-compress-1.21-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10618-1- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2021-36090 No score
CVE-2021-36090 in io.root.org.apache.commons:commons-compress - Patched by Root
Root has patched CVE-2021-36090 in the io.root.org.apache.commons:commons-compress package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2021-36090- Updated
- 2026-11-02
OSVSUSE-SU-2021:2612-1 No score
Security update for apache-commons-compress
This update for apache-commons-compress fixes the following issues:
- Updated to 1.21
- CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. (bsc#1188463)
- CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. (bsc#1188464)
- CVE-2021-35517: Fixed an excessive memory allocation when reading a specially crafted TAR archive. (bsc#1188465)
- CVE-2021-36090: Fixed an excessive memory allocation when reading a specially crafted ZIP archive. (bsc#1188466)
- Record
SUSE-SU-2021:2612-1- Updated
- 2026-11-02
Affected products
- apache commons compress
- apache software foundation commons compress
- netapp active iq unified manager
- netapp oncommand insight
- oracle banking apis
- oracle banking digital experience
- oracle banking enterprise default management
- oracle banking party management
- oracle banking payments
- oracle banking platform
- oracle banking trade finance
- oracle banking treasury management
Show 23 moreShow less
- oracle business process management suite
- oracle commerce guided search
- oracle communications billing and revenue management
- oracle communications cloud native core automated test suite
- oracle communications cloud native core service communication proxy
- oracle communications cloud native core unified data repository
- oracle communications diameter intelligence hub
- oracle communications element manager
- oracle communications messaging server
- oracle communications session report manager
- oracle communications session route manager
- oracle communications unified inventory management
- oracle financial services analytical applications infrastructure
- oracle financial services crime and compliance management studio
- oracle financial services enterprise case management
- oracle flexcube universal banking
- oracle healthcare data repository
- oracle insurance policy administration
- oracle peoplesoft enterprise peopletools
- oracle primavera gateway
- oracle primavera unifier
- oracle utilities testing accelerator
- oracle webcenter portal
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.commons:commons-compressMaven |
before 1.21 | 1.21 |
apache-commons-compressAzure Linux:3 |
through 1.19-3 | None known |
org.apache.commons:commons-compressTuxCare:Maven From an advisory covering 5 CVEs |
1.20 up to 1.20-tuxcare.1 | 1.20-tuxcare.1 |
org.apache.commons:commons-compressTuxCare:Maven From an advisory covering 4 CVEs |
1.19 up to 1.19-tuxcare.2, plus listed versions 1.19-tuxcare.1 |
1.19-tuxcare.2 |
libcommons-compress-javaDebian:12 |
before 1.21-1 | 1.21-1 |
libcommons-compress-javaDebian:13 |
before 1.21-1 | 1.21-1 |
libcommons-compress-javaDebian:14 |
before 1.21-1 | 1.21-1 |
org.apache.commons:commons-compressMaven |
before 1.21, plus listed versions 1.01.11.101.111.12 Show 19 moreShow less1.131.141.151.161.16.11.171.181.191.21.201.31.41.4.11.51.61.71.81.8.11.9 |
1.21 |
osgi-coreMageia:8 From an advisory covering 4 CVEs |
before 8.0.0-1.mga8 | 8.0.0-1.mga8 |
apache-commons-compressMageia:8 From an advisory covering 4 CVEs |
before 1.21-1.mga8 | 1.21-1.mga8 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
apache-commons-compressopenEuler:20.03-LTS-SP1 From an advisory covering 4 CVEs |
before 1.21-1.oe1 | 1.21-1.oe1 |
apache-commons-compressopenEuler:20.03-LTS-SP2 From an advisory covering 4 CVEs |
before 1.21-1.oe1 | 1.21-1.oe1 |
org.apache.commons:commons-compressRed Hat Lightwell:Maven From an advisory covering 5 CVEs |
before 1.9.0.rhlw-00005, plus listed versions 1.01.11.21.31.4 Show 8 moreShow less1.4.11.51.61.71.81.8.11.91.9.0 |
1.9.0.rhlw-00005 |
ovirt-web-uiRed Hat:rhev_manager:4.4:el8 From an advisory covering 9 CVEs |
before 0:1.9.0-1.el8ev | 0:1.9.0-1.el8ev |
ovirt-dependenciesRed Hat:rhev_manager:4.4:el8 From an advisory covering 9 CVEs |
before 0:4.5.2-1.el8ev | 0:4.5.2-1.el8ev |
apache-commons-compressRed Hat:rhev_manager:4.4:el8 From an advisory covering 9 CVEs |
before 0:1.21-1.2.el8ev | 0:1.21-1.2.el8ev |
apache-commons-compress-javadocRed Hat:rhev_manager:4.4:el8 From an advisory covering 9 CVEs |
before 0:1.21-1.2.el8ev | 0:1.21-1.2.el8ev |
io.root.org.apache.commons:commons-compressRoot:Maven |
before 1.21-root.io.1 | 1.21-root.io.11.21-root.io.2 |
org.apache.commons:commons-compressRoot:Maven |
before 1.21-aikido.2 | 1.21-aikido.2 |
apache-commons-compressSUSE:Linux Enterprise Module for Development Tools 15 SP2 From an advisory covering 4 CVEs |
before 1.21-3.3.1 | 1.21-3.3.1 |
apache-commons-compressSUSE:Linux Enterprise Module for Development Tools 15 SP3 From an advisory covering 4 CVEs |
before 1.21-3.3.1 | 1.21-3.3.1 |
libcommons-compress-javaUbuntu:16.04:LTS |
All versions, plus listed versions 1.9-11.10-11.10-2 |
None known |
libcommons-compress-javaUbuntu:18.04:LTS |
All versions, plus listed versions 1.13-11.13-21.18-1~18.04 |
None known |
libcommons-compress-javaUbuntu:20.04:LTS |
All versions, plus listed versions 1.18-31.19-1 |
None known |
libcommons-compress-javaUbuntu:22.04:LTS |
All versions, plus listed versions 1.20-11.21-1 |
None known |
libcommons-compress-javaUbuntu:24.04:LTS |
All versions, plus listed versions 1.23.0-11.24.0-11.25.0-1 |
None known |
libcommons-compress-javaUbuntu:25.10 |
All versions, plus listed versions 1.27.1-2 |
None known |
libcommons-compress-javaUbuntu:26.10 |
All versions, plus listed versions 1.27.1-2 |
None known |
libcommons-compress-javaUbuntu:26.04:LTS |
All versions, plus listed versions 1.27.1-2 |
None known |
apache-commons-compressopenSUSE:Leap 15.2 From an advisory covering 4 CVEs |
before 1.21-lp152.2.3.1 | 1.21-lp152.2.3.1 |
apache-commons-compressopenSUSE:Leap 15.3 From an advisory covering 4 CVEs |
before 1.21-3.3.1 | 1.21-3.3.1 |
apache-commons-compressopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 1.21-1.2 | 1.21-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-36090 is a high vulnerability (CVSS 7.5) in Apache Commons Compress, published July 13, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.9%, the 96th percentile. Fixed in org.apache.commons:commons-compress 1.21.
References
commons.apache.org/proper/commons-compress/security-reports.html
lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E
openwall.com/lists/oss-security/2021/07/13/4
Show 168 moreShow less
oracle.com/security-alerts/cpuoct2021.html
security.netapp.com/advisory/ntap-20211022-0001
nvd.nist.gov/vuln/detail/CVE-2021-36090
github.com/advisories/GHSA-mc84-pj99-q6hh
security-tracker.debian.org/tracker/CVE-2021-36090
advisories.mageia.org/MGASA-2022-0009.html
bugs.mageia.org/show_bug.cgi?id=29254
lists.opensuse.org/archives/list/[email protected]/thread/XVOH7P2WI6SSS2OORQJBS45T5SKKO7BV
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1302
repo.maven.apache.org/maven2
access.redhat.com/errata/RHSA-2022:5555
bugzilla.redhat.com/show_bug.cgi?id=1663217
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5555.json
cve.org/CVERecord?id=CVE-2021-3807
huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
suse.com/support/update/announcement/2021/suse-su-20212612-1
bugzilla.suse.com/1188463
ubuntu.com/security/CVE-2021-36090