{"id":"CVE-2018-1324","aliases":["CLSA-2026-1785909110","CLSA-2026-1785936779","CLSA-2026-1785947990","DEBIAN-CVE-2018-1324","EUVD-2019-0384","GHSA-h436-432x-8fvx","MGASA-2019-0001","UBUNTU-CVE-2018-1324"],"status":"published","title":"Apache Commons Compress vulnerable to denial of service due to infinite loop","description":"A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03656,"percentile":0.89694,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-835"],"published":"2018-03-16T13:00:00Z","modified":"2026-10-24T10:30:50Z","exploits":[{"source":"pocgithub","id":"tafamace/CVE-2018-1324","title":"tafamace/CVE-2018-1324","date":"2018-11-19","url":"https://github.com/tafamace/CVE-2018-1324"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.commons:commons-compress","fixed_in":["1.16"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.liferay:com.liferay.portal.tools.bundle.support","fixed_in":["3.7.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-compress","fixed_in":["1.12-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libcommons-compress-java","fixed_in":["1.13-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcommons-compress-java","fixed_in":["1.13-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcommons-compress-java","fixed_in":["1.13-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11"},{"fixed":"1.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.liferay:com.liferay.portal.tools.bundle.support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7"},{"fixed":"3.7.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.takari:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12"},{"last_affected":"1.12"}]}],"versions":["1.12"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12"},{"fixed":"1.12-tuxcare.1"}]}],"versions":["1.12"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14"},{"fixed":"1.14-tuxcare.1"}]}],"versions":["1.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15-tuxcare.1"}]}],"versions":["1.15"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11"},{"fixed":"1.16"}]}],"versions":["1.11","1.12","1.13","1.14","1.15"]},{"source":"osv","ecosystem":"Maven","package":"com.liferay:com.liferay.portal.tools.bundle.support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7"},{"fixed":"3.7.4"}]}],"versions":["3.2.7","3.3.0","3.4.0","3.4.1","3.4.2","3.4.3","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.6.0","3.6.1","3.7.0","3.7.1","3.7.2","3.7.3"]},{"source":"osv","ecosystem":"Maven","package":"io.takari:commons-compress","versions":["1.12"]},{"source":"osv","ecosystem":"Mageia:6","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.2.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9-1","1.10-1","1.10-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18-3","1.19-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20-1","1.21-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.0-1","1.24.0-1","1.25.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27.1-2"]}],"products":[{"vendor":"apache","product":"commons_compress"},{"vendor":"apache software foundation","product":"apache commons compress"},{"vendor":"oracle","product":"mysql_cluster"},{"vendor":"oracle","product":"weblogic_server"}],"references":[{"url":"http://www.securitytracker.com/id/1040549","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.apache.org/thread.html/1c7b6df6d1c5c8583518a0afa017782924918e4d6acfaf23ed5b2089%40%3Cdev.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/103490","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b8ef29df0f1d55aa741170748352ae8e425c7b1d286b2f257711a2dd%40%3Cdev.creadur.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5532dc8d5456b5151e8c286801e2e5769f5c04118b29c3b5d13ea387%40%3Cissues.beam.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1324","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h436-432x-8fvx","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/1c7b6df6d1c5c8583518a0afa017782924918e4d6acfaf23ed5b2089@%3Cdev.commons.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/b8ef29df0f1d55aa741170748352ae8e425c7b1d286b2f257711a2dd@%3Cdev.creadur.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r5532dc8d5456b5151e8c286801e2e5769f5c04118b29c3b5d13ea387@%3Cissues.beam.apache.org%3E","tags":["web"]},{"url":"https://arxiv.org/pdf/2306.05534.pdf","tags":["web"]},{"url":"https://github.com/jensdietrich/xshady-release/tree/main/CVE-2018-1324","tags":["web"]},{"url":"https://github.com/apache/commons-compress/commit/2a2f1dc48e22a34ddb72321a4db211da91aa933b","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1324","tags":["advisory"]},{"url":"https://github.com/apache/commons-compress","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2019-0001.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22787","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UJ7GKBUCVEHQVGOXIOT6EWCRVDZJMHGK/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FLKWBUZ7KVAJV6VZAY2UYW5JIEVMRT2R/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-1324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1324","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-1324","description":"A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.","status":"published","published":"2018-03-16T13:00:00Z","modified":"2024-09-17T03:59:32.872Z","updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2019-0384","description":"A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.","status":"published","published":"2018-03-16T13:00:00Z","modified":"2024-09-17T03:59:32Z","updated_at":"2026-11-03T00:28:27.115818Z"}],"ghsa":[{"id":"GHSA-h436-432x-8fvx","title":"Apache Commons Compress vulnerable to denial of service due to infinite loop","description":"A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.","status":"published","published":"2019-03-14T15:41:12Z","modified":"2024-02-27T18:28:59Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:37:38.935144Z"}],"nvd":[{"id":"CVE-2018-1324","description":"A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.","status":"published","published":"2018-03-16T13:29:00.36Z","modified":"2026-06-17T01:51:01.427Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:04:24.264003Z"}],"osv":[{"id":"CVE-2018-1324","description":"A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.","status":"published","published":"2018-03-16T13:29:00.36Z","modified":"2026-10-24T10:30:50.572655651Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-1324","description":"A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.","status":"published","published":"2018-03-16T13:29:00.36Z","modified":"2026-10-23T18:03:54.385467318Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"GHSA-h436-432x-8fvx","title":"Apache Commons Compress vulnerable to denial of service due to infinite loop","description":"A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.","status":"published","published":"2019-03-14T15:41:12Z","modified":"2024-02-27T18:34:05.707371Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"UBUNTU-CVE-2018-1324","description":"A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.","status":"published","published":"2018-03-16T13:29:00Z","modified":"2026-10-17T12:54:52.699036531Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"CLSA-2026-1785909110","title":"TuxCare security update for org.apache.commons:commons-compress (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.12-tuxcare.1.","status":"published","published":"2026-08-05T05:51:50Z","modified":"2026-10-15T09:46:44.321551072Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785936779","title":"TuxCare security update for org.apache.commons:commons-compress (2 CVEs)","description":"TuxCare rebuilt org.apache.commons:commons-compress to address 2 CVEs. Fixed in 1.14-tuxcare.1.","status":"published","published":"2026-08-05T13:32:59Z","modified":"2026-10-15T09:45:16.573748241Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785947990","title":"TuxCare security update for org.apache.commons:commons-compress (3 CVEs)","description":"TuxCare rebuilt org.apache.commons:commons-compress to address 3 CVEs. Fixed in 1.15-tuxcare.1.","status":"published","published":"2026-08-05T16:39:50Z","modified":"2026-10-15T09:47:24.989791169Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"MGASA-2019-0001","title":"Updated pache-commons-compress packages fix security vulnerabilities","description":"A flaw was found in Apache Commons Compress versions 1.11 to 1.15. A\nspecially crafted ZIP archive can be used to cause an infinite loop\ninside of Apache Commons Compress' extra field parser used by the\nZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15.\nThis can be used to mount a denial of service attack against services\nthat use Compress' zip package (CVE-2018-1324).\n\nApache Commons Compress versions 1.7 to 1.17 are vulnerable to a denial\nof service attack via crafted ZIP archive. When reading a specially\ncrafted ZIP archive, the read method of ZipArchiveInputStream can fail\nto return the correct EOF indication after the end of the stream has\nbeen reached.  When combined with a java.io.InputStreamReader this can\nlead to an infinite stream, which can be used to mount a denial of\nservice attack against services that use Compress' zip package\n(CVE-2018-11771).\n","status":"published","published":"2019-01-05T18:30:16Z","modified":"2026-04-16T06:24:54.196447351Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}