CVE-2022-24615

Uncaught Exception in zip4j

5.5 MediumFix available

zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.71%Down 0.2 points since Feb 25, 2022

What each source reports

NVD Score used 5.5

Record: CVE-2022-24615
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-755
Updated: 2026-11-02

CVE List No score

Record: CVE-2022-24615
Updated: 2026-11-02

EUVDEUVD-2022-1146 No score

Record: EUVD-2022-1146
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q62h-jw38-24vh 5.5

Uncaught Exception in zip4j

zip4j up to 2.9.1 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.

Record: GHSA-q62h-jw38-24vh
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-248, CWE-755
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-24615 5.5

Record: DEBIAN-CVE-2022-24615
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVGHSA-q62h-jw38-24vh 5.5

Uncaught Exception in zip4j

Record: GHSA-q62h-jw38-24vh
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-248, CWE-755
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-24615 5.5

Record: UBUNTU-CVE-2022-24615
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV No score

Record: CVE-2022-24615
Updated: 2026-11-02

Affected products

zip4j project zip4j

Affected packages

Affected packages
Package	Affected	Fixed
`net.lingala.zip4j:zip4j` Maven	before 2.10.0	2.10.0
`zip4j` Debian:12	before 2.10.0-1	2.10.0-1
`zip4j` Debian:13	before 2.10.0-1	2.10.0-1
`zip4j` Debian:14	before 2.10.0-1	2.10.0-1
`net.lingala.zip4j:zip4j` Maven	before 2.10.0, plus listed versions 1.2.31.2.41.2.51.2.61.2.7 Show 39 moreShow less 1.2.81.2.91.3.11.3.21.3.32.02.0.12.0.22.0.32.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.3.02.3.12.3.22.4.02.5.02.5.12.5.22.6.02.6.12.6.22.6.32.6.42.7.02.8.02.9.02.9.1	2.10.0
`zip4j` Ubuntu:20.04:LTS	All versions, plus listed versions 2.1.2-22.2.2-12.2.6-12.2.8-1	None known
`zip4j` Ubuntu:22.04:LTS	All versions, plus listed versions 2.6.4-12.9.0-12.9.1-1	None known
`zip4j` Ubuntu:24.04:LTS	All versions, plus listed versions 2.11.5-1	None known
`zip4j` Ubuntu:25.10	All versions, plus listed versions 2.11.5-1	None known
`zip4j` Ubuntu:26.10	All versions, plus listed versions 2.11.6-1	None known
`zip4j` Ubuntu:26.04:LTS	All versions, plus listed versions 2.11.5-12.11.5-1build12.11.6-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-24615 is a medium vulnerability (CVSS 5.5) in Zip4j Project Zip4j, published February 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in net.lingala.zip4j:zip4j 2.10.0.