CVE-2019-12402
Denial of Service in Apache Commons Compress
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
- Record
CVE-2019-12402- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-835
- Updated
- 2026-11-02
CVE List No score
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
- Record
CVE-2019-12402- Updated
- 2026-11-02
EUVDEUVD-2019-0685 No score
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
- Record
EUVD-2019-0685- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-53x6-4x5p-rrvv
Denial of Service in Apache Commons Compress
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
- Record
GHSA-53x6-4x5p-rrvv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSV
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
- Record
CVE-2019-12402- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12402
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
- Record
DEBIAN-CVE-2019-12402- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-53x6-4x5p-rrvv
Denial of Service in Apache Commons Compress
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
- Record
GHSA-53x6-4x5p-rrvv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12402
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
- Record
UBUNTU-CVE-2019-12402- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1784769508 No score
TuxCare security update for org.apache.commons:commons-compress (1 CVE)
TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.18-tuxcare.2.
- Record
CLSA-2026-1784769508- Updated
- 2026-11-02
OSVCLSA-2026-1785947990 No score
TuxCare security update for org.apache.commons:commons-compress (3 CVEs)
TuxCare rebuilt org.apache.commons:commons-compress to address 3 CVEs. Fixed in 1.15-tuxcare.1.
- Record
CLSA-2026-1785947990- Updated
- 2026-11-02
OSVMGASA-2020-0001 No score
Updated apache-commons-compress- packages fix security vulnerability
pdated apache-commons-compress packages fix security vulnerability:
A resource consumption vulnerability was discovered in apache-commons- compress in the way NioZipEncoding encodes filenames. Applications that use Compress to create archives, with one of the filenames within the archive being controlled by the user, may be vulnerable to this flaw. A remote attacker could exploit this flaw to cause an infinite loop during the archive creation, thus leading to a denial of service (CVE-2019-12402).
- Record
MGASA-2020-0001- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10618-1 No score
apache-commons-compress-1.21-1.2 on GA media
These are all security issues fixed in the apache-commons-compress-1.21-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10618-1- Updated
- 2026-11-02
Affected products
- apache commons compress
- apache software foundation commons compress
- fedoraproject fedora
- oracle banking payments
- oracle banking platform
- oracle communications element manager
- oracle communications ip service activator
- oracle communications session report manager
- oracle communications session route manager
- oracle customer management and segmentation foundation
- oracle essbase
- oracle flexcube investor servicing
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.commons:commons-compressMaven |
1.15 up to 1.19 | 1.19 |
io.github.1tchy.java9modular.org.apache.commons:commons-compressMaven |
1.18.1 to 1.18.1 | None known |
org.apache.commons:commons-compressTuxCare:Maven |
1.18 up to 1.18-tuxcare.2, plus listed versions 1.18-tuxcare.1 |
1.18-tuxcare.2 |
org.apache.commons:commons-compressTuxCare:Maven From an advisory covering 3 CVEs |
1.15 up to 1.15-tuxcare.1 | 1.15-tuxcare.1 |
libcommons-compress-javaDebian:12 |
before 1.18-3 | 1.18-3 |
libcommons-compress-javaDebian:13 |
before 1.18-3 | 1.18-3 |
libcommons-compress-javaDebian:14 |
before 1.18-3 | 1.18-3 |
org.apache.commons:commons-compressMaven |
1.15 up to 1.19, plus listed versions 1.161.16.11.171.18 |
1.19 |
io.github.1tchy.java9modular.org.apache.commons:commons-compressMaven |
Listed versions 1.18.1 |
None known |
apache-commons-compressMageia:7 |
before 1.19-1.mga7 | 1.19-1.mga7 |
libcommons-compress-javaUbuntu:18.04:LTS |
All versions, plus listed versions 1.13-11.13-21.18-1~18.04 |
None known |
apache-commons-compressopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 1.21-1.2 | 1.21-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12402 is a high vulnerability (CVSS 7.5) in Apache Commons Compress, published August 29, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.2%, the 96th percentile. Fixed in org.apache.commons:commons-compress 1.19.
References
lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea%40%3Ccommits.creadur.apache.org%3E
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7
Show 60 moreShow less
oracle.com/security-alerts/cpuapr2020.html
security.netapp.com/advisory/ntap-20230818-0001
nvd.nist.gov/vuln/detail/CVE-2019-12402
github.com/jensdietrich/xshady-release/tree/main/CVE-2019-12402
security-tracker.debian.org/tracker/CVE-2019-12402
advisories.mageia.org/MGASA-2020-0001.html
bugs.mageia.org/show_bug.cgi?id=25365
ubuntu.com/security/CVE-2019-12402
openwall.com/lists/oss-security/2019/08/27/1
cve.org/CVERecord?id=CVE-2019-12402
suse.com/security/cve/CVE-2019-12402