CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

First published: Tue Jul 13 2021(Updated: )

A flaw was found in apache-commons-compress. When reading a specially crafted TAR archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This flaw allows the mounting of a denial of service attack against services that use Compress' TAR package. The highest threat from this vulnerability is to system availability.

Credit: security@apache.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-cve
• agent/type
• agent/first-publish-date
• agent/weakness
• agent/remedy
• agent/author
• agent/severity
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2021-35517
• agent/software-canonical-lookup
• agent/description
• collector/nvd-index
• agent/software-canonical-lookup-request
• agent/softwarecombine
• collector/mitre-cve
• source/MITRE
• agent/title
• agent/references
• agent/last-modified-date
• agent/tags
• agent/event
• package-manager/redhat
• vendor/apache
• canonical/apache commons compress
• version/apache commons compress/1.1
• version/apache commons compress/1.20
• vendor/netapp
• canonical/netapp active iq unified manager linux
• canonical/netapp active iq unified manager vmware vsphere
• canonical/netapp active iq unified manager windows
• canonical/netapp oncommand insight
• vendor/oracle
• canonical/oracle banking apis
• version/oracle banking apis/18.1
• version/oracle banking apis/18.3
• version/oracle banking apis/19.1
• version/oracle banking apis/19.2
• version/oracle banking apis/20.1
• version/oracle banking apis/21.1
• canonical/oracle banking digital experience
• version/oracle banking digital experience/18.1
• version/oracle banking digital experience/18.3
• version/oracle banking digital experience/19.1
• version/oracle banking digital experience/19.2
• version/oracle banking digital experience/20.1
• version/oracle banking digital experience/21.1
• canonical/oracle banking enterprise default management
• version/oracle banking enterprise default management/2.7.0
• canonical/oracle banking party management
• version/oracle banking party management/2.7.0
• canonical/oracle banking payments
• version/oracle banking payments/14.5
• canonical/oracle banking trade finance
• version/oracle banking trade finance/14.5
• canonical/oracle banking treasury management
• version/oracle banking treasury management/14.5
• canonical/oracle business process management suite
• version/oracle business process management suite/12.2.1.3.0
• version/oracle business process management suite/12.2.1.4.0
• canonical/oracle commerce guided search
• version/oracle commerce guided search/11.3.2
• canonical/oracle communications billing and revenue management
• version/oracle communications billing and revenue management/12.0.0.4
• canonical/oracle communications cloud native core service communication proxy
• version/oracle communications cloud native core service communication proxy/1.14.0
• canonical/oracle communications cloud native core unified data repository
• version/oracle communications cloud native core unified data repository/1.14.0
• canonical/oracle communications diameter intelligence hub
• version/oracle communications diameter intelligence hub/8.0.0
• version/oracle communications diameter intelligence hub/8.2.3
• canonical/oracle communications session route manager
• version/oracle communications session route manager/8.0.0
• version/oracle communications session route manager/8.2.5
• canonical/oracle financial services crime and compliance management studio
• version/oracle financial services crime and compliance management studio/8.0.8.2.0
• version/oracle financial services crime and compliance management studio/8.0.8.3.0
• canonical/oracle financial services enterprise case management
• version/oracle financial services enterprise case management/8.0.7.2.0
• version/oracle financial services enterprise case management/8.0.8.1.0
• canonical/oracle flexcube universal banking
• version/oracle flexcube universal banking/14.0.0
• version/oracle flexcube universal banking/14.3.0
• version/oracle flexcube universal banking/12.4
• version/oracle flexcube universal banking/14.5
• canonical/oracle healthcare data repository
• version/oracle healthcare data repository/8.1.0
• canonical/oracle insurance policy administration
• version/oracle insurance policy administration/11.0.2
• version/oracle insurance policy administration/11.1.0
• version/oracle insurance policy administration/11.2.8
• version/oracle insurance policy administration/11.3.0
• version/oracle insurance policy administration/11.3.1
• canonical/oracle peoplesoft enterprise peopletools
• version/oracle peoplesoft enterprise peopletools/8.57
• version/oracle peoplesoft enterprise peopletools/8.58
• version/oracle peoplesoft enterprise peopletools/8.59
• canonical/oracle primavera unifier
• version/oracle primavera unifier/17.7
• version/oracle primavera unifier/17.12
• version/oracle primavera unifier/18.8
• version/oracle primavera unifier/19.12
• version/oracle primavera unifier/20.12
• canonical/oracle utilities testing accelerator
• version/oracle utilities testing accelerator/6.0.0.1.1
• version/oracle utilities testing accelerator/6.0.0.2.2
• version/oracle utilities testing accelerator/6.0.0.3.1
• canonical/oracle webcenter portal
• version/oracle webcenter portal/12.2.1.3.0
• version/oracle webcenter portal/12.2.1.4.0
• canonical/oracle communications messaging server
• version/oracle communications messaging server/8.1