Description
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-compress-java | 1.4.1-1 | — |
| Debian 13 | libcommons-compress-java | 1.4.1-1 | — |
| Debian 12 | libcommons-compress-java | 1.4.1-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.commons:commons-compress | < 1.4.1 | 1.4.1 | GHSA-6fxm-66hq-fc96 |
Advisories 1
- WID-SEC-2022-1738 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025
References
- FEDORA-2013-5548 vendor-advisory
- apache-commons-ant-bzip2-dos(75857) vdb-entry
- FEDORA-2012-8428 vendor-advisory
- 20120523 [CVE-2012-2098] Apache Commons Compress and Apache Ant denial of service vulnerability mailing-list
- 82161 vdb-entry
- 53676 vdb-entry
- 1027096 vdb-entry
- 49255 third-party-advisory
- FEDORA-2012-8465 vendor-advisory
- 49286 third-party-advisory
- FEDORA-2013-5546 vendor-advisory
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1 mailing-list
- http://commons.apache.org/compress/security.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21644047
- http://packetstormsecurity.org/files/113014/Apache-Commons-Compress-Apache-Ant-Denial-Of-Service.html
- http://ant.apache.org/security.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- [oss-security] 20230913 CVE-2023-42503: Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file mailing-list