Description
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Commons Compress | 1.15 to 1.18 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-compress-java | 1.18-3 | — |
| Debian 13 | libcommons-compress-java | 1.18-3 | — |
| Debian 12 | libcommons-compress-java | 1.18-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libcommons-compress-java | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-compress | 1.21-1.2 | openSUSE-SU-2024:10618-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.github.1tchy.java9modular.org.apache.commons:commons-compress | 1.18.1 | — | GHSA-53x6-4x5p-rrvv |
| Maven | org.apache.commons:commons-compress | >= 1.15, < 1.19 | 1.19 | GHSA-53x6-4x5p-rrvv |
Advisories 5
- openSUSE-SU-2024:10618-1 apache-commons-compress-1.21-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0770 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2024-1773 Apache Commons Compress: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Aug 6, 2024
- WID-SEC-2024-1627 Atlassian Confluence: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
References
- [creadur-commits] 20191022 [creadur-rat] branch master updated: RAT-258: Update to latest commons-compress to fix CVE-2019-12402 mailing-list
- FEDORA-2019-c96a8d12b0 vendor-advisory
- FEDORA-2019-da0eac1eb6 vendor-advisory
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- [flink-issues] 20200306 [GitHub] [flink] nielsbasjes opened a new pull request #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200306 [GitHub] [flink] flinkbot edited a comment on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200306 [GitHub] [flink] flinkbot commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200310 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200311 [GitHub] [flink] nielsbasjes commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200311 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200311 [GitHub] [flink] flinkbot edited a comment on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200311 [GitHub] [flink] nielsbasjes edited a comment on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200312 [GitHub] [flink] zentol commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200312 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200313 [GitHub] [flink] GJL commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200313 [GitHub] [flink] zentol commented on issue #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [flink-issues] 20200313 [GitHub] [flink] GJL closed pull request #11333: [FLINK-14121] Update commons-compress because of CVE-2019-12402 mailing-list
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1 mailing-list
- [lucene-solr-user] 20200320 Re: CVEs (vulnerabilities) that apply to Solr 8.4.1 mailing-list
- [brooklyn-dev] 20200403 [GitHub] [brooklyn-server] nakomis opened a new pull request #1089: Bumps commons-compress version mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b%40%3Cdev.commons.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20230818-0001/