Description
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Commons Compress | Apache Commons Compress – ≤ 1.20 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-compress-java | 1.21-1 | — |
| Debian 13 | libcommons-compress-java | 1.21-1 | — |
| Debian 12 | libcommons-compress-java | 1.21-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libcommons-compress-java | No fix yet | — |
| Ubuntu 26.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 25.10 | libcommons-compress-java | No fix yet | — |
| Ubuntu 24.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 22.04 LTS | libcommons-compress-java | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 18.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 16.04 LTS | libcommons-compress-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | apache-commons-compress +1 | 1.21-1.2.el8ev | RHSA-2022:5555 |
| Red Hat Rhev Manager 4 | ovirt-dependencies | 4.5.2-1.el8ev | RHSA-2022:5555 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.9.0-1.el8ev | RHSA-2022:5555 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | apache-commons-compress | 1.21-3.3.1 | SUSE-SU-2021:2612-1 |
| SLES 15 SP2 | apache-commons-compress | 1.21-3.3.1 | SUSE-SU-2021:2612-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-compress | 1.21-1.2 | openSUSE-SU-2024:10618-1 |
| openSUSE Leap 15.3 | apache-commons-compress | 1.21-3.3.1 | openSUSE-SU-2021:2612-1 |
| openSUSE Leap 15.2 | apache-commons-compress | 1.21-lp152.2.3.1 | openSUSE-SU-2021:1115-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | apache-commons-compress +1 | 1.21-4.amzn2023.0.3 | ALAS2023-2025-841 |
| Amazon Linux 2 | apache-commons-compress +1 | 1.5-4.amzn2.0.2 | ALAS2-2024-2627 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | apache-commons-compress | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.commons:commons-compress | < 1.21 | 1.21 | GHSA-mc84-pj99-q6hh |
Advisories 20
- RHSA-2022:5555 Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- WID-SEC-2022-0699 Red Hat Virtualization: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 1, 2026
- WID-SEC-2024-0123 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 7, 2026
- openSUSE-SU-2021:2612-1 Security update for apache-commons-compress SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10618-1 apache-commons-compress-1.21-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2612-1 Security update for apache-commons-compress SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- openSUSE-SU-2021:1115-1 Security update for apache-commons-compress SUSE / openSUSE Security Updates · May 7, 2025
- ALAS2023-2025-841 Moderate: apache-commons-compress security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 21, 2025
- WID-SEC-2023-0426 IBM Spectrum Protect: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 6, 2025
- WID-SEC-2024-2180 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- ALAS2-2024-2627 Moderate: apache-commons-compress security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 20, 2024
- NCSC-2024-0305 Kwetsbaarheden verholpen in Oracle Siebel CRM NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1653 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-1627 Atlassian Confluence: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2023-1016 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-0132 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 1, 2023
- WID-SEC-2023-1017 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
References
- https://commons.apache.org/proper/commons-compress/security-reports.html
- https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E
- [oss-security] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability mailing-list
- [announce] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability mailing-list
- [ant-user] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability mailing-list
- [announce] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability mailing-list
- [oss-security] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability mailing-list
- [james-notifications] 20210714 [GitHub] [james-project] chibenwa opened a new pull request #537: [UPGRADE] Security upgrade: common-compress to 1.21 mailing-list
- [pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 mailing-list
- [druid-commits] 20210726 [GitHub] [druid] suneet-s opened a new pull request #11496: Address CVE-2021-35515 CVE-2021-36090 mailing-list
- [druid-commits] 20210726 [GitHub] [druid] suneet-s merged pull request #11496: Address CVE-2021-35515 CVE-2021-36090 mailing-list
- [druid-commits] 20210726 [druid] branch master updated: Address CVE-2021-35515 CVE-2021-36090 (#11496) mailing-list
- [skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) mailing-list
- [skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 mailing-list
- [drill-dev] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 mailing-list
- [drill-issues] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 mailing-list
- [drill-dev] 20210804 [GitHub] [drill] luocooong opened a new pull request #2285: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 mailing-list
- [drill-commits] 20210804 [drill] branch master updated: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 mailing-list
- [drill-dev] 20210804 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 mailing-list
- [drill-issues] 20210804 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 mailing-list
- [drill-dev] 20210805 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 mailing-list
- [drill-issues] 20210805 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 mailing-list
- [tomcat-dev] 20210811 [GitHub] [tomcat-jakartaee-migration] ebourg commented on issue #23: Vulnerability with Apache Commons Compress v1.20 mailing-list
- [poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://security.netapp.com/advisory/ntap-20211022-0001/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html