CVE-2018-1324
Apache Commons Compress vulnerable to denial of service due to infinite loop
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
- Record
CVE-2018-1324- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-835
- Updated
- 2026-11-02
CVE List No score
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
- Record
CVE-2018-1324- Updated
- 2026-11-02
EUVDEUVD-2019-0384 No score
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
- Record
EUVD-2019-0384- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h436-432x-8fvx
Apache Commons Compress vulnerable to denial of service due to infinite loop
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
- Record
GHSA-h436-432x-8fvx- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSV
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
- Record
CVE-2018-1324- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1324
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
- Record
DEBIAN-CVE-2018-1324- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-h436-432x-8fvx
Apache Commons Compress vulnerable to denial of service due to infinite loop
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
- Record
GHSA-h436-432x-8fvx- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1324
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
- Record
UBUNTU-CVE-2018-1324- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1785909110 No score
TuxCare security update for org.apache.commons:commons-compress (1 CVE)
TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.12-tuxcare.1.
- Record
CLSA-2026-1785909110- Updated
- 2026-11-02
OSVCLSA-2026-1785936779 No score
TuxCare security update for org.apache.commons:commons-compress (2 CVEs)
TuxCare rebuilt org.apache.commons:commons-compress to address 2 CVEs. Fixed in 1.14-tuxcare.1.
- Record
CLSA-2026-1785936779- Updated
- 2026-11-02
OSVCLSA-2026-1785947990 No score
TuxCare security update for org.apache.commons:commons-compress (3 CVEs)
TuxCare rebuilt org.apache.commons:commons-compress to address 3 CVEs. Fixed in 1.15-tuxcare.1.
- Record
CLSA-2026-1785947990- Updated
- 2026-11-02
OSVMGASA-2019-0001 No score
Updated pache-commons-compress packages fix security vulnerabilities
A flaw was found in Apache Commons Compress versions 1.11 to 1.15. A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package (CVE-2018-1324).
Apache Commons Compress versions 1.7 to 1.17 are vulnerable to a denial of service attack via crafted ZIP archive. When reading a specially crafted ZIP archive, the read method of ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package (CVE-2018-11771).
- Record
MGASA-2019-0001- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.commons:commons-compressMaven |
1.11 up to 1.16 | 1.16 |
com.liferay:com.liferay.portal.tools.bundle.supportMaven |
3.2.7 up to 3.7.4 | 3.7.4 |
io.takari:commons-compressMaven |
1.12 to 1.12 | None known |
org.apache.commons:commons-compressTuxCare:Maven |
1.12 up to 1.12-tuxcare.1 | 1.12-tuxcare.1 |
org.apache.commons:commons-compressTuxCare:Maven From an advisory covering 2 CVEs |
1.14 up to 1.14-tuxcare.1 | 1.14-tuxcare.1 |
org.apache.commons:commons-compressTuxCare:Maven From an advisory covering 3 CVEs |
1.15 up to 1.15-tuxcare.1 | 1.15-tuxcare.1 |
libcommons-compress-javaDebian:12 |
before 1.13-2 | 1.13-2 |
libcommons-compress-javaDebian:13 |
before 1.13-2 | 1.13-2 |
libcommons-compress-javaDebian:14 |
before 1.13-2 | 1.13-2 |
org.apache.commons:commons-compressMaven |
1.11 up to 1.16, plus listed versions 1.121.131.141.15 |
1.16 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.portal.tools.bundle.supportMaven |
3.2.7 up to 3.7.4, plus listed versions 3.3.03.4.03.4.13.4.23.4.3 Show 13 moreShow less3.5.03.5.13.5.23.5.33.5.43.5.53.5.63.6.03.6.13.7.03.7.13.7.23.7.3 |
3.7.4 |
io.takari:commons-compressMaven |
Listed versions 1.12 |
None known |
apache-commons-compressMageia:6 From an advisory covering 2 CVEs |
before 1.12-1.2.mga6 | 1.12-1.2.mga6 |
libcommons-compress-javaUbuntu:16.04:LTS |
All versions, plus listed versions 1.9-11.10-11.10-2 |
None known |
libcommons-compress-javaUbuntu:20.04:LTS |
All versions, plus listed versions 1.18-31.19-1 |
None known |
libcommons-compress-javaUbuntu:22.04:LTS |
All versions, plus listed versions 1.20-11.21-1 |
None known |
libcommons-compress-javaUbuntu:24.04:LTS |
All versions, plus listed versions 1.23.0-11.24.0-11.25.0-1 |
None known |
libcommons-compress-javaUbuntu:25.10 |
All versions, plus listed versions 1.27.1-2 |
None known |
libcommons-compress-javaUbuntu:26.10 |
All versions, plus listed versions 1.27.1-2 |
None known |
libcommons-compress-javaUbuntu:26.04:LTS |
All versions, plus listed versions 1.27.1-2 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | tafamace/CVE-2018-1324 | 2018-11-19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1324 is a medium vulnerability (CVSS 5.5) in Apache Commons Compress, published March 16, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.66%, the 89th percentile. Fixed in org.apache.commons:commons-compress 1.16.
References
securitytracker.com/id/1040549
lists.apache.org/thread.html/1c7b6df6d1c5c8583518a0afa017782924918e4d6acfaf23ed5b2089%40%3Cdev.commons.apache.org%3E
securityfocus.com/bid/103490
Show 18 moreShow less
oracle.com/security-alerts/cpujan2022.html
nvd.nist.gov/vuln/detail/CVE-2018-1324
github.com/advisories/GHSA-h436-432x-8fvx
arxiv.org/pdf/2306.05534.pdf
security-tracker.debian.org/tracker/CVE-2018-1324
advisories.mageia.org/MGASA-2019-0001.html
bugs.mageia.org/show_bug.cgi?id=22787
lists.fedoraproject.org/archives/list/[email protected]/thread/UJ7GKBUCVEHQVGOXIOT6EWCRVDZJMHGK
ubuntu.com/security/CVE-2018-1324
cve.org/CVERecord?id=CVE-2018-1324