CVE-2021-35517: apache software foundation apache commons compress
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2021-35517DEBIAN-CVE-2021-35517CGA-28qx-9g9w-xqfcCGA-2mff-xv6h-g7v9CGA-2mr7-m2rv-8xjwCGA-2phr-p725-cmv9CGA-2rv4-rwx7-6mqvCGA-2vf7-8wq5-rg62CGA-2x52-rgpm-cwc2CGA-32cq-3mxp-rh2xCGA-38f8-wrp4-486jCGA-38rx-2g98-vfx5CGA-39v6-x2xr-x5m5CGA-3f77-g7xc-2x77CGA-3hq3-26fj-g53vCGA-3jrh-f9hg-r5p7CGA-3jv7-6mfp-5jm3CGA-3pm2-9hwp-3r6fCGA-3qpw-558v-mrpqCGA-3x3j-88hg-ffxgCGA-3x67-c644-6cfpCGA-45cr-jj9m-jcfhCGA-47r2-f76p-v8qhCGA-48h4-pfq8-f4jgCGA-49xh-mcc4-m2rjCGA-4hx2-fc58-25wcCGA-4q28-3h8j-9m9qCGA-4qj9-qpq3-rvwxCGA-4rg9-5x87-h3qmCGA-4vq3-j5gg-x3jxCGA-523g-7wrj-53jmCGA-55ch-hv8q-4rw6CGA-5626-wcq9-928jCGA-5654-5v8r-gvfpCGA-5889-f4rh-m563CGA-5f9j-gfgj-2m6fCGA-5mcg-j57m-887mCGA-5r78-m4j5-64p4CGA-5rwv-ph68-hcwrCGA-5wqj-wgw9-4qghCGA-65v5-34px-rj4gCGA-6fgg-x652-v4pvCGA-6hxj-84xh-q285CGA-6pfg-9p36-gchxCGA-7287-65cq-pqhmCGA-7c89-hr2h-r527CGA-83j8-34xf-x3j6CGA-863r-237r-2pg2CGA-8c2r-gw2g-37qvCGA-8chw-frwp-262vCGA-8j8v-gr8c-4rrjCGA-8v8p-5799-m3hwCGA-8vvv-7hq9-hxgwCGA-8w84-gr3w-h2r4CGA-9fr2-rjrp-jxvvCGA-9hph-xmxx-3c9vCGA-9j3q-3r43-5h23CGA-9w2x-m2j7-44qrCGA-9xq5-2xrw-mqxfCGA-c353-vwmr-36v9CGA-c3c9-3gcq-j972CGA-cc88-6gx4-vcv3CGA-ccm2-hv64-mf2gCGA-cmpx-mjc5-rg35CGA-cw73-4f2x-jxpwCGA-cxhm-x42m-q327CGA-f2pr-qgg5-2j25CGA-f35w-rrxx-v5wjCGA-f3qv-7727-m9vxCGA-f5c3-fv5g-xqxmCGA-fg4v-2p9h-rr99CGA-fj97-vf7q-2cc8CGA-fjh2-cjwh-v862CGA-frch-j6vg-g9g6CGA-fw3c-77qq-2c28CGA-g35w-8g36-5p22CGA-g45q-fj3h-wh53CGA-g4vh-vqc6-mv89CGA-g527-pchc-g8fmCGA-g5w9-x526-g9mjCGA-g6mm-2mxw-h4qmCGA-g9jx-9499-r8jhCGA-h222-qhmm-fjpfCGA-h33c-c376-g39qCGA-h57v-xrm9-cpj3CGA-h943-2r3f-q76vCGA-h9hq-qqqj-3wrqCGA-hppg-7vxf-9v48CGA-hppj-3fp6-gv62CGA-j4x9-p95h-fghjCGA-j59q-8cq9-9xxvCGA-j6c5-93v8-49xrCGA-j7r6-fwxp-8pq5CGA-j9m4-xm54-2r98CGA-j9wq-pqjj-f2rmCGA-jw9q-383q-6h6vCGA-m5fw-h949-xxm6CGA-m7jr-h5wh-wpx4CGA-m7w9-vfwf-mvh8CGA-m88r-9c68-hg5vCGA-m98p-9x49-wq7qCGA-m9vh-6jmv-frjcCGA-mc72-383w-rrqhCGA-mg2c-4q6g-qxq7CGA-mghx-3vwc-6gw2CGA-mp6x-rr6q-476cCGA-mr86-q4wq-9wvwCGA-mx9p-rmph-95c7CGA-p2xq-94pq-pj4hCGA-p32m-5hx6-6684CGA-p827-mpw4-w3wgCGA-p8fg-q8qx-hp48CGA-p8vx-4f52-c9qrCGA-ph2h-7h6w-mw3gCGA-ppj8-mhcm-p9w2CGA-pqhc-wq32-9cg6GHSA-xqfj-vm6h-2x34CGA-q596-25w6-pjqcCGA-qc8g-w3vj-6xjvCGA-qj4q-8ppw-qx46CGA-qm3r-wqq4-95whCGA-qwmg-772v-j6f7CGA-qxwc-r46j-m5p2CGA-r5hr-ph4p-f8p8CGA-r7q2-jq6r-p6mmCGA-r9v5-j68c-42qvCGA-rj7p-758f-phjwCGA-rjwr-c345-988cCGA-rrw3-rjj2-w65gCGA-rrxp-2jj2-fg5pCGA-rwg7-mhjc-v4j2CGA-v3f3-q5wr-m4x5CGA-v3hx-gjqg-hhj3CGA-v476-g47r-28ghCGA-v593-524f-99xgCGA-v6pf-hjr6-9mhcCGA-v75p-g8pv-8q3fCGA-v7gp-xm82-5426CGA-v7v5-6x78-rxcvCGA-vc34-9pm6-g2f4CGA-vff5-3g4f-cxj9CGA-vvp5-fp2f-6mc5CGA-vxq5-j54g-7w44CGA-w8vw-9q8j-7573CGA-wf55-q96f-5xpfCGA-wgmc-fjhm-q95cCGA-wgpq-qwc6-95fvCGA-wgx8-xp73-7fj7CGA-wpgm-9mf6-3f9wCGA-wqj8-7w5m-74w8CGA-wqpm-34w5-xxpjCGA-wqrp-4wrc-5fq4CGA-x2g2-4w29-qm82CGA-x5gp-ghgw-hcpwCGA-x9cq-ggg2-9hjjCGA-xj94-hwvf-qc9pCGA-xr99-5gmq-855h
Published 13-07-2021Last modified 08-10-2026
Vulnerability summary
CVE-2021-35517 is a high (CVSS 7.5) vulnerability in apache software foundation apache commons compress. EPSS estimates a 10.61% chance of exploitation in the next 30 days, higher than 95.7% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
10.61%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 4Timeline
- 13-07-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
10.61%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 10.61% on 18-09-2026
18-09-202618-10-2026
EPSS score10.61%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard67 products
- eco-java-gradle-4.10All versions (No fix recorded)
- eco-java-gradle-4.10.1All versions (No fix recorded)
- eco-java-gradle-4.10.2All versions (No fix recorded)
- eco-java-gradle-4.10.3All versions (No fix recorded)
- eco-java-gradle-4.2All versions (No fix recorded)
Oracle24 products
- banking_apis≥ 18.1, ≤ 18.3 | 19.1 | 19.2 | 20.1 | 21.1
- banking_digital_experience≥ 18.1, ≤ 18.3 | 19.1 | 19.2 | 20.1 | 21.1
- banking_enterprise_default_management2.7.0
- banking_party_management2.7.0
- banking_payments14.5
Netapp2 products
Apache1 product
- commons_compress≥ 1.1, ≤ 1.20
Apache software foundation1 product
- apache commons compress≥ 1.1, < Apache Commons Compress*
Debian1 product
- libcommons-compress-java< 1.21-1
Org.apache.commons1 product
- commons-compress< 1.21
Ubuntu1 product
- libcommons-compress-javaAll versions (No fix recorded)
8 vendors · 98 products
References
41 links- commons.apache.org/proper/commons-compress/security-reports.htmlX Refsource MISCREPORTAdvisoryWEBVendor Advisory
- www.openwall.com/lists/oss-security/2021/07/13/3Mailing ListX Refsource MLISTREPORTAdvisoryWEBThird Party Advisory
- www.openwall.com/lists/oss-security/2021/07/13/5Mailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
