CVE-2021-35516: apache software foundation apache commons compress
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2021-35516DEBIAN-CVE-2021-35516CGA-243f-j938-cwj2CGA-24r6-49vj-f996CGA-2693-xwh2-r4ghCGA-2cx6-xv48-q253CGA-2j4f-84pm-h6jwCGA-2qvg-m3gm-jxr9CGA-2rp9-9wp5-hpmvCGA-2xmw-38ww-76q2CGA-2xqg-5m7q-8mpcCGA-3788-m4ff-jrf8CGA-38x5-p4mj-gpchCGA-39vr-f85h-8fjmCGA-3c3g-82qr-4x65CGA-3jh6-79p7-76hpCGA-3mw4-6hgx-wrqvCGA-422c-jp9q-4g94CGA-46f2-wwfr-92fxCGA-4g7w-4869-w442CGA-4mf8-x4mp-5v7pCGA-4pvq-ghv6-25fjCGA-4qv9-hhq6-293rCGA-4vww-7f3p-65cgCGA-4x8x-338v-7h5mCGA-53cw-5qch-98f9CGA-579f-m2q2-236fCGA-58mp-4w4r-4qrgCGA-5f62-6fh4-pr46CGA-5grp-q88j-rm44CGA-5gwj-fw47-g477CGA-5qgp-9fqx-r8jcCGA-5v6q-gfrq-5pvgCGA-5wqp-v3xq-4jhxCGA-6226-g37v-ggmwCGA-6284-7x59-wp3xCGA-67cj-jgwr-456vCGA-686c-jw43-65mgCGA-68gg-6x2h-3fxcCGA-68x9-hp9g-3q4xCGA-6f24-vrcr-w2w4CGA-6m4g-p539-x6p7CGA-6m9f-gmjw-x28gCGA-6mv9-4g99-6jwrCGA-6p4c-5fc6-33vvCGA-72j3-qf8f-5g87CGA-76c9-85p3-g353CGA-7765-6c7h-64g9CGA-7fw8-frww-rrwxCGA-7g5m-8gjh-vfqwCGA-7h2m-pcrf-h3fpCGA-7pvv-p6mq-2w6fCGA-82fx-gv3f-gqhwCGA-83mc-xgwv-r8f3CGA-8fpr-wr58-c5jpCGA-8hcw-464j-43pgCGA-8v6c-j85g-6j6qCGA-94f9-295x-cj8cCGA-978m-mgxg-jvmgCGA-97j6-w6cv-3924CGA-9cp2-9jpg-mvvqCGA-9pf5-4w5w-vw23CGA-9q75-2rq6-v257CGA-9qhf-3fh3-5f6mCGA-c3g7-f7pp-8mfgCGA-c3wv-2xgq-cfrwCGA-c5cp-qjq3-x2grCGA-c7qj-qvg9-f4q7CGA-cg2v-9rpp-p59wCGA-cg6q-vm8q-c4pcCGA-cgjm-p426-rpc4CGA-cgwf-cfh5-jx64CGA-cxh7-q635-pmgqCGA-ffcq-fh93-c73gCGA-fg83-g25f-q22jCGA-fqr8-rvcr-j6cqCGA-g8p9-r58f-6666CGA-gf3g-m4xv-6f73CGA-gf7c-wgq4-5mw3CGA-grxh-8jhv-4rvjCGA-h225-37j9-jcgmCGA-h6qg-qr3p-h6pcCGA-hcg3-gj24-m878CGA-hpr3-3fv9-7wx3CGA-hprm-h5c6-grq8CGA-hqcf-cv57-cfvvCGA-hvhj-5wqf-mxrwCGA-hxrh-2gfv-jg8hCGA-j4mv-jq3q-fc97CGA-j59w-7hwx-j9phCGA-j62x-p35q-x6crCGA-j8jc-qmw2-m5fxCGA-j9ww-fwwq-7g8rCGA-jmqg-69rh-qx8qCGA-jq2v-p4w7-7hr7CGA-jqmv-98m9-89j5CGA-jrwj-6g7g-3xg6CGA-jwrf-p5mw-9hf7CGA-jx24-rpqv-pvc7CGA-m3xc-7rpq-76pxCGA-m7wm-52f5-hqgfCGA-m874-4p6v-rrw4CGA-mg8f-h7cg-rw28CGA-mj4m-mgxx-gw3qCGA-mj73-cvw2-pv2xCGA-mjj6-3cq2-f9j7CGA-mv4w-pfw4-m99rCGA-p29f-rpw4-5f5jCGA-p89j-whfp-p8jqCGA-pcq8-hgp9-6cp4CGA-phrm-5w7v-qjgpCGA-pp4v-5x2x-7vxmCGA-pprw-gf7q-6mpxCGA-pw2p-67c2-fr6vGHSA-crv7-7245-f45fCGA-pwjr-ppq5-8cr5CGA-q7v3-6jgq-284cCGA-qhm9-6cr2-vh3rCGA-qjgf-hhw6-wc3mCGA-qm57-fcx2-2m78CGA-qmfw-wffq-673mCGA-qvxc-23g8-62hxCGA-qw2r-735x-rghjCGA-r5jq-5xh6-rxqgCGA-r5wf-p746-h38hCGA-r7rj-wf6g-9phgCGA-r7vh-5v5w-rw6jCGA-r7vw-33xm-hr3qCGA-r9jq-837r-wwhqCGA-rc8c-3wmf-fj44CGA-rccc-jx84-ff27CGA-rgm2-xvp6-4h29CGA-rm8c-2ccf-gg69CGA-rpgg-22qm-xqfgCGA-rxc6-8m53-f82xCGA-v276-x5qj-jwrqCGA-v5q2-8qg2-3q6fCGA-v6m2-jxm5-w52qCGA-v6x2-fjfv-w63qCGA-v79q-7w53-fg6jCGA-v7c8-hm62-x4fhCGA-vfw3-c935-jg38CGA-vm34-w6qc-vq77CGA-vpg8-985p-h24rCGA-vpxh-rcff-6c72CGA-vr2h-458f-p623CGA-w3vf-vfh8-99g7CGA-w9x4-2q6f-7c5rCGA-wf3m-98jj-5c9xCGA-wgq3-65w5-8cr6CGA-wj29-99c4-7q7rCGA-x7gw-9mgc-65m9CGA-xhxc-mj5f-r248CGA-xm48-8vwp-25v9CGA-xr85-hfx4-xq24CGA-xv34-5qmr-7j27CGA-xwfw-mc4r-93cr
Published 13-07-2021Last modified 04-08-2024
Vulnerability summary
CVE-2021-35516 is a high (CVSS 7.5) vulnerability in apache software foundation apache commons compress. EPSS estimates a 12.37% chance of exploitation in the next 30 days, higher than 96.1% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
12.37%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 4Timeline
- 13-07-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
12.37%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 12.37% on 18-09-2026
18-09-202618-10-2026
EPSS score12.37%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard67 products
- eco-java-gradle-4.10All versions (No fix recorded)
- eco-java-gradle-4.10.1All versions (No fix recorded)
- eco-java-gradle-4.10.2All versions (No fix recorded)
- eco-java-gradle-4.10.3All versions (No fix recorded)
- eco-java-gradle-4.2All versions (No fix recorded)
Oracle21 products
- banking_digital_experience≥ 18.1, ≤ 18.3 | 19.1 | 19.2 | 20.1 | 21.1
- banking_enterprise_default_management2.7.0
- banking_party_management2.7.0
- business_process_management_suite12.2.1.3.0 | 12.2.1.4.0
- commerce_guided_search11.3.2
Netapp2 products
Apache1 product
- commons_compress≥ 1.6, ≤ 1.20
Apache software foundation1 product
- apache commons compress≥ 1.6, < Apache Commons Compress*
Debian1 product
- libcommons-compress-java< 1.21-1
Org.apache.commons1 product
- commons-compress< 1.21
Ubuntu1 product
- libcommons-compress-javaAll versions (No fix recorded)
8 vendors · 95 products
References
34 links- commons.apache.org/proper/commons-compress/security-reports.htmlX Refsource MISCREPORTAdvisoryWEBVendor Advisory
- www.openwall.com/lists/oss-security/2021/07/13/2Mailing ListX Refsource MLISTREPORTAdvisoryWEBThird Party Advisory
