Description
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Commons Compress | 1.1 – < Apache Commons Compress* | Apache Commons Compress* |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-compress-java | 1.21-1 | — |
| Debian 13 | libcommons-compress-java | 1.21-1 | — |
| Debian 12 | libcommons-compress-java | 1.21-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libcommons-compress-java | No fix yet | — |
| Ubuntu 26.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 25.10 | libcommons-compress-java | No fix yet | — |
| Ubuntu 24.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 22.04 LTS | libcommons-compress-java | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 18.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 16.04 LTS | libcommons-compress-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | apache-commons-compress +1 | 1.21-1.2.el8ev | RHSA-2022:5555 |
| Red Hat Rhev Manager 4 | ovirt-dependencies | 4.5.2-1.el8ev | RHSA-2022:5555 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.9.0-1.el8ev | RHSA-2022:5555 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | apache-commons-compress | 1.21-3.3.1 | SUSE-SU-2021:2612-1 |
| SLES 15 SP2 | apache-commons-compress | 1.21-3.3.1 | SUSE-SU-2021:2612-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-compress | 1.21-1.2 | openSUSE-SU-2024:10618-1 |
| openSUSE Leap 15.3 | apache-commons-compress | 1.21-3.3.1 | openSUSE-SU-2021:2612-1 |
| openSUSE Leap 15.2 | apache-commons-compress | 1.21-lp152.2.3.1 | openSUSE-SU-2021:1115-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | apache-commons-compress | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.commons:commons-compress | < 1.21 | 1.21 | GHSA-xqfj-vm6h-2x34 |
Advisories 10
- RHSA-2022:5555 Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- WID-SEC-2022-0699 Red Hat Virtualization: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 1, 2026
- openSUSE-SU-2021:2612-1 Security update for apache-commons-compress SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10618-1 apache-commons-compress-1.21-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2612-1 Security update for apache-commons-compress SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- openSUSE-SU-2021:1115-1 Security update for apache-commons-compress SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2023-0426 IBM Spectrum Protect: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 6, 2025
- WID-SEC-2024-1627 Atlassian Confluence: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
References
- https://commons.apache.org/proper/commons-compress/security-reports.html
- https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E
- [oss-security] 20210713 CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability mailing-list
- [announce] 20210713 CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability mailing-list
- [ant-user] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability mailing-list
- [announce] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability mailing-list
- [oss-security] 20210713 CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability mailing-list
- [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 mailing-list
- [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) mailing-list
- [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [flink-issues] 20210908 [GitHub] [flink] MartijnVisser opened a new pull request #17194: [FLINK-24034] Upgrade commons-compress to 1.21 and other apache.commons updates mailing-list
- [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://security.netapp.com/advisory/ntap-20211022-0001/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html