{"id":"CVE-2019-12402","aliases":["CLSA-2026-1784769508","CLSA-2026-1785947990","DEBIAN-CVE-2019-12402","EUVD-2019-0685","GHSA-53x6-4x5p-rrvv","MGASA-2020-0001","UBUNTU-CVE-2019-12402","openSUSE-SU-2024:10618-1"],"status":"published","title":"Denial of Service in Apache Commons Compress","description":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.16157,"percentile":0.96954,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2019-08-29T00:00:00Z","modified":"2026-10-24T10:30:34Z","fixes":[{"ecosystem":"Maven","package":"org.apache.commons:commons-compress","fixed_in":["1.19"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-compress","fixed_in":["1.18-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libcommons-compress-java","fixed_in":["1.18-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcommons-compress-java","fixed_in":["1.18-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcommons-compress-java","fixed_in":["1.18-3"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"apache-commons-compress","fixed_in":["1.19-1.mga7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.19"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.github.1tchy.java9modular.org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.1"},{"last_affected":"1.18.1"}]}],"versions":["1.18.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18"},{"fixed":"1.18-tuxcare.2"}]}],"versions":["1.18","1.18-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15-tuxcare.1"}]}],"versions":["1.15"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.commons:commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.19"}]}],"versions":["1.15","1.16","1.16.1","1.17","1.18"]},{"source":"osv","ecosystem":"Maven","package":"io.github.1tchy.java9modular.org.apache.commons:commons-compress","versions":["1.18.1"]},{"source":"osv","ecosystem":"Mageia:7","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19-1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libcommons-compress-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13-1","1.13-2","1.18-1~18.04"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21-1.2"}]}],"bundled":5}],"products":[{"vendor":"apache","product":"commons_compress"},{"vendor":"apache software foundation","product":"apache commons compress"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"banking_payments"},{"vendor":"oracle","product":"banking_platform"},{"vendor":"oracle","product":"communications_element_manager"},{"vendor":"oracle","product":"communications_ip_service_activator"},{"vendor":"oracle","product":"communications_session_report_manager"},{"vendor":"oracle","product":"communications_session_route_manager"},{"vendor":"oracle","product":"customer_management_and_segmentation_foundation"},{"vendor":"oracle","product":"essbase"},{"vendor":"oracle","product":"flexcube_investor_servicing"},{"vendor":"oracle","product":"flexcube_private_banking"},{"vendor":"oracle","product":"hyperion_infrastructure_technology"},{"vendor":"oracle","product":"jdeveloper"},{"vendor":"oracle","product":"peoplesoft_enterprise_pt_peopletools"},{"vendor":"oracle","product":"primavera_gateway"},{"vendor":"oracle","product":"retail_integration_bus"},{"vendor":"oracle","product":"retail_xstore_point_of_service"},{"vendor":"oracle","product":"webcenter_portal"}],"references":[{"url":"https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea%40%3Ccommits.creadur.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZB3GB7YXIOUKIOQ27VTIP6KKGJJ3CKL/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5caf4fcb69d2749225391e61db7216282955204849ba94f83afe011f%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rcc35ab6be300365de5ff9587e0479d10d7d7c79070921837e3693162%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re13bd219dd4b651134f6357f12bd07a0344eea7518c577bbdd185265%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5103b1c9242c0f812ac96e524344144402cbff9b6e078d1557bc7b1e%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r590c15cebee9b8e757e2f738127a9a71e48ede647a3044c504e050a4%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r05cf37c1e1e662e968cfece1102fcd50fe207181fdbf2c30aadfafd3%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rdebc1830d6c09c11d5a4804ca26769dbd292d17d361c61dea50915f0%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd3f99d732baed459b425fb0a9e9e14f7843c9459b12037e4a9d753b5%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r21d64797914001119d2fc766b88c6da181dc2308d20f14e7a7f46117%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r233267e24519bacd0f9fb9f61a1287cb9f4bcb6e75d83f34f405c521%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r25422df9ad22fec56d9eeca3ab8bd6d66365e9f6bfe311b64730edf5%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r972f82d821b805d04602976a9736c01b6bf218cfe0c3f48b472db488%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r4363c994c8bca033569a98da9218cc0c62bb695c1e47a98e5084e5a0%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r7af60fbd8b2350d49d14e53a3ab2801998b9d1af2d6fcac60b060a53%40%3Cdev.brooklyn.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b%40%3Cdev.commons.apache.org%3E","tags":["x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred","Not Applicable","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230818-0001/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12402","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b@%3Cdev.commons.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea@%3Ccommits.creadur.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r05cf37c1e1e662e968cfece1102fcd50fe207181fdbf2c30aadfafd3@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r21d64797914001119d2fc766b88c6da181dc2308d20f14e7a7f46117@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r233267e24519bacd0f9fb9f61a1287cb9f4bcb6e75d83f34f405c521@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r25422df9ad22fec56d9eeca3ab8bd6d66365e9f6bfe311b64730edf5@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r4363c994c8bca033569a98da9218cc0c62bb695c1e47a98e5084e5a0@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r5103b1c9242c0f812ac96e524344144402cbff9b6e078d1557bc7b1e@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r590c15cebee9b8e757e2f738127a9a71e48ede647a3044c504e050a4@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r5caf4fcb69d2749225391e61db7216282955204849ba94f83afe011f@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7af60fbd8b2350d49d14e53a3ab2801998b9d1af2d6fcac60b060a53@%3Cdev.brooklyn.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r972f82d821b805d04602976a9736c01b6bf218cfe0c3f48b472db488@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rcc35ab6be300365de5ff9587e0479d10d7d7c79070921837e3693162@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd3f99d732baed459b425fb0a9e9e14f7843c9459b12037e4a9d753b5@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rdebc1830d6c09c11d5a4804ca26769dbd292d17d361c61dea50915f0@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/re13bd219dd4b651134f6357f12bd07a0344eea7518c577bbdd185265@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZB3GB7YXIOUKIOQ27VTIP6KKGJJ3CKL/"},{"url":"https://github.com/jensdietrich/xshady-release/tree/main/CVE-2019-12402","tags":["web"]},{"url":"https://github.com/advisories/GHSA-53x6-4x5p-rrvv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12402","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230818-0001","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZB3GB7YXIOUKIOQ27VTIP6KKGJJ3CKL","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2020-0001.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25365","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-12402","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/08/27/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12402","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36090","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-12402","description":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.","status":"published","published":"2019-08-29T00:00:00Z","modified":"2024-08-04T23:17:39.992Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-0685","description":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.","status":"published","published":"2019-08-29T00:00:00Z","modified":"2024-08-04T23:17:39Z","updated_at":"2026-11-03T02:40:46.416719Z"}],"ghsa":[{"id":"GHSA-53x6-4x5p-rrvv","title":"Denial of Service in Apache Commons Compress","description":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.","status":"published","published":"2019-10-11T18:41:08Z","modified":"2023-10-09T22:16:00Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:37:08.847568Z"}],"nvd":[{"id":"CVE-2019-12402","description":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.","status":"published","published":"2019-08-30T09:15:17.91Z","modified":"2026-06-17T02:14:34.853Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:05:25.691233Z"}],"osv":[{"id":"CVE-2019-12402","description":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.","status":"published","published":"2019-08-30T09:15:17.91Z","modified":"2026-10-24T10:30:34.915176523Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-12402","description":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.","status":"published","published":"2019-08-30T09:15:17.91Z","modified":"2026-09-21T07:02:02.498422096Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-53x6-4x5p-rrvv","title":"Denial of Service in Apache Commons Compress","description":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.","status":"published","published":"2019-10-11T18:41:08Z","modified":"2024-03-16T05:19:51.25548Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"UBUNTU-CVE-2019-12402","description":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.","status":"published","published":"2019-08-30T09:15:00Z","modified":"2025-10-24T04:47:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"CLSA-2026-1784769508","title":"TuxCare security update for org.apache.commons:commons-compress (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.18-tuxcare.2.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:29.832498666Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785947990","title":"TuxCare security update for org.apache.commons:commons-compress (3 CVEs)","description":"TuxCare rebuilt org.apache.commons:commons-compress to address 3 CVEs. Fixed in 1.15-tuxcare.1.","status":"published","published":"2026-08-05T16:39:50Z","modified":"2026-10-15T09:47:24.989791169Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"MGASA-2020-0001","title":"Updated apache-commons-compress- packages fix security vulnerability","description":"pdated apache-commons-compress packages fix security vulnerability:\n\nA resource consumption vulnerability was discovered in apache-commons-\ncompress in the way NioZipEncoding encodes filenames. Applications that\nuse Compress to create archives, with one of the filenames within the\narchive being controlled by the user, may be vulnerable to this flaw.\nA remote attacker could exploit this flaw to cause an infinite loop during\nthe archive creation, thus leading to a denial of service (CVE-2019-12402).\n","status":"published","published":"2020-01-05T15:37:51Z","modified":"2026-04-16T04:43:55.471827322Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:10618-1","title":"apache-commons-compress-1.21-1.2 on GA media","description":"These are all security issues fixed in the apache-commons-compress-1.21-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:30:21.757523Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}