{"id":"CVE-2012-2098","aliases":["DEBIAN-CVE-2012-2098","EUVD-2022-2784","GHSA-6fxm-66hq-fc96","MGASA-2014-0056"],"status":"published","title":"Uncontrolled Resource Consumption in Apache Commons Compress","description":"Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.12806,"percentile":0.96314,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310","CWE-400"],"published":"2012-06-29T00:00:00Z","modified":"2026-10-23T17:47:32Z","fixes":[{"ecosystem":"Maven","package":"org.apache.commons:commons-compress","fixed_in":["1.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libcommons-compress-java","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcommons-compress-java","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcommons-compress-java","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"plexus-archiver","fixed_in":["2.3-1.1.mga3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}],"versions":["1.0","1.1","1.2","1.3","1.4"]},{"source":"osv","ecosystem":"Mageia:3","package":"plexus-archiver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-1.1.mga3"}]}]}],"products":[{"vendor":"apache","product":"commons_compress"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105060.html","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/75857","tags":["vdb-entry","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081697.html","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-05/0130.html","tags":["mailing-list","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://osvdb.org/82161","tags":["vdb-entry","x_transferred","Broken Link","web"]},{"url":"http://www.securityfocus.com/bid/53676","tags":["vdb-entry","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securitytracker.com/id?1027096","tags":["vdb-entry","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://secunia.com/advisories/49255","tags":["third-party-advisory","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081746.html","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://secunia.com/advisories/49286","tags":["third-party-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105049.html","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"http://commons.apache.org/compress/security.html","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21644047","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://packetstormsecurity.org/files/113014/Apache-Commons-Compress-Apache-Ant-Denial-Of-Service.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://ant.apache.org/security.html","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/09/13/3","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2098","tags":["advisory"]},{"url":"https://web.archive.org/web/20130525085523/http://www.securityfocus.com/bid/53676","tags":["web"]},{"url":"https://web.archive.org/web/20140724002926/http://secunia.com/advisories/49286","tags":["web"]},{"url":"https://web.archive.org/web/20140724023114/http://secunia.com/advisories/49255","tags":["web"]},{"url":"https://web.archive.org/web/20200517014414/http://www.securitytracker.com/id?1027096","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/020c03d8ef579e80511023fb46ece30e9c3dd27d","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/0600296ab8f8a0bbdfedd483f51b38005eb8e34e","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/1ce57d976c4f25fe99edcadf079840c278f3cb84","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/2ab2fcb356753927afaa731b9d2dcc47d3083408","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/654222e628097763ee6ca561ae77be5c06666173","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/6ced422bf5eca3aac05396367bafb33ec21bf74e","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/6e95697e783767f3549f00d7d2e1b002eac4a3d4","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/8f702469cbf4c451b6dea349290bc4af0f6f76c7","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/b06f7b41c936ef1a79589d16ea5c1d8b93f71f66","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/cca0e6e5341aacddefd4c4d36cef7cbdbc2a8777","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/ea31005111f0abede7e43e4ba0012e62e0808b22","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/fdd7459bc5470e90024dbe762249166481cce769","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@\u003csolr-user.lucene.apache.org\u003e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6fxm-66hq-fc96"},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-2098","tags":["advisory"]},{"url":"https://github.com/apache/commons-compress","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0056.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=6331","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2012-June/081697.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-May/105060.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-2098","description":"Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.","status":"published","published":"2012-06-29T00:00:00Z","modified":"2024-08-06T19:26:07.686Z","updated_at":"2026-11-02T14:34:49.937255Z"}],"euvd":[{"id":"EUVD-2022-2784","description":"Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.","status":"published","published":"2012-06-29T00:00:00Z","modified":"2024-08-06T19:26:07Z","updated_at":"2026-11-03T01:56:15.412642Z"}],"ghsa":[{"id":"GHSA-6fxm-66hq-fc96","title":"Uncontrolled Resource Consumption in Apache Commons Compress","description":"Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.","status":"published","published":"2022-05-13T01:07:05Z","modified":"2024-02-22T15:15:54Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:38.935144Z"}],"nvd":[{"id":"CVE-2012-2098","description":"Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.","status":"published","published":"2012-06-29T19:55:03.53Z","modified":"2026-06-16T23:40:59.133Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:14.774945Z"}],"osv":[{"id":"CVE-2012-2098","description":"Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.","status":"published","published":"2012-06-29T19:55:03Z","modified":"2026-04-16T06:26:24.215404907Z","updated_at":"2026-11-02T15:43:58.537032Z"},{"id":"DEBIAN-CVE-2012-2098","description":"Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.","status":"published","published":"2012-06-29T19:55:03.53Z","modified":"2026-10-23T17:47:32.573849131Z","updated_at":"2026-11-02T15:45:24.92418Z"},{"id":"GHSA-6fxm-66hq-fc96","title":"Uncontrolled Resource Consumption in Apache Commons Compress","description":"Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.","status":"published","published":"2022-05-13T01:07:05Z","modified":"2024-11-28T05:48:23.160032Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"MGASA-2014-0056","title":"Updated plexus-archiver package fixes security vulnerability","description":"Algorithmic complexity vulnerability in the sorting algorithms in bzip2\ncompressing stream (BZip2CompressorOutputStream) in Apache Commons Compress\nbefore 1.4.1 allows remote attackers to cause a denial of service (CPU\nconsumption) via a file with many repeating inputs (CVE-2012-2098).\n\nplexus-archiver used an embedded copy of the affected code from Apache\nCommons Compress, and therefore was affected by this.  It has been patched\nto use the apache-commons-compress package, in which this issue has already\nbeen fixed, for bzip2 compression and decompression.\n","status":"published","published":"2014-02-12T17:07:07Z","modified":"2026-04-16T06:22:53.548382295Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}