CVE-2021-36090: apache software foundation apache commons compress

CVSS: 7.5v3.1HighModified

AliasesUBUNTU-CVE-2021-36090DEBIAN-CVE-2021-36090CGA-247q-9j7p-4r7c+154 more

Published 13-07-2021Last modified 08-10-2026

Vulnerability summary

CVE-2021-36090 is a high (CVSS 7.5) vulnerability in apache software foundation apache commons compress. EPSS estimates a 12.95% chance of exploitation in the next 30 days, higher than 96.2% of scored vulnerabilities.

Overall risk

33/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

12.95%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 4

MGASA-2022-0009 OPENSUSE-SU-2021:1115-1 OPENSUSE-SU-2021:2612-1 OPENSUSE-SU-2024:10618-1 RHSA-2022:5555 SUSE-SU-2021:2612-1

Timeline

13-07-2021
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

12.95%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 12.95% on 18-09-2026

18-09-202618-10-2026

EPSS score

12.95%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Affected systems

Chainguard67 products

eco-java-gradle-4.10All versions (No fix recorded)
eco-java-gradle-4.10.1All versions (No fix recorded)
eco-java-gradle-4.10.2All versions (No fix recorded)
eco-java-gradle-4.10.3All versions (No fix recorded)
eco-java-gradle-4.2All versions (No fix recorded)

eco-java-gradle-4.2.1All versions (No fix recorded)
eco-java-gradle-4.3All versions (No fix recorded)
eco-java-gradle-4.3.1All versions (No fix recorded)
eco-java-gradle-4.4All versions (No fix recorded)
eco-java-gradle-4.4.1All versions (No fix recorded)
eco-java-gradle-4.5All versions (No fix recorded)
eco-java-gradle-4.5.1All versions (No fix recorded)
eco-java-gradle-4.6All versions (No fix recorded)
eco-java-gradle-4.7All versions (No fix recorded)
eco-java-gradle-4.8All versions (No fix recorded)
eco-java-gradle-4.8.1All versions (No fix recorded)
eco-java-gradle-4.9All versions (No fix recorded)
eco-java-gradle-5.0All versions (No fix recorded)
eco-java-gradle-5.1All versions (No fix recorded)
eco-java-gradle-5.1.1All versions (No fix recorded)
eco-java-gradle-5.2All versions (No fix recorded)
eco-java-gradle-5.2.1All versions (No fix recorded)
eco-java-gradle-5.3All versions (No fix recorded)
eco-java-gradle-5.3.1All versions (No fix recorded)
eco-java-gradle-5.4All versions (No fix recorded)
eco-java-gradle-5.4.1All versions (No fix recorded)
eco-java-gradle-5.5All versions (No fix recorded)
eco-java-gradle-5.5.1All versions (No fix recorded)
eco-java-gradle-5.6All versions (No fix recorded)
eco-java-gradle-5.6.1All versions (No fix recorded)
eco-java-gradle-5.6.2All versions (No fix recorded)
eco-java-gradle-5.6.3All versions (No fix recorded)
eco-java-gradle-5.6.4All versions (No fix recorded)
eco-java-gradle-6.0All versions (No fix recorded)
eco-java-gradle-6.0.1All versions (No fix recorded)
eco-java-gradle-6.1All versions (No fix recorded)
eco-java-gradle-6.1.1All versions (No fix recorded)
eco-java-gradle-6.2All versions (No fix recorded)
eco-java-gradle-6.2.1All versions (No fix recorded)
eco-java-gradle-6.2.2All versions (No fix recorded)
eco-java-gradle-6.3All versions (No fix recorded)
eco-java-gradle-6.4All versions (No fix recorded)
eco-java-gradle-6.4.1All versions (No fix recorded)
eco-java-gradle-6.5All versions (No fix recorded)
eco-java-gradle-6.5.1All versions (No fix recorded)
eco-java-gradle-6.6All versions (No fix recorded)
eco-java-gradle-6.6.1All versions (No fix recorded)
eco-java-gradle-6.7All versions (No fix recorded)
eco-java-gradle-6.7.1All versions (No fix recorded)
eco-java-gradle-6.8All versions (No fix recorded)
eco-java-gradle-6.8.1All versions (No fix recorded)
eco-java-gradle-6.8.2All versions (No fix recorded)
eco-java-gradle-6.8.3All versions (No fix recorded)
eco-java-gradle-6.9All versions (No fix recorded)
eco-java-gradle-6.9.1All versions (No fix recorded)
eco-java-gradle-6.9.2All versions (No fix recorded)
eco-java-gradle-6.9.3All versions (No fix recorded)
eco-java-gradle-6.9.4All versions (No fix recorded)
eco-java-gradle-7.0All versions (No fix recorded)
eco-java-gradle-7.0.1All versions (No fix recorded)
eco-java-gradle-7.0.2All versions (No fix recorded)
eco-java-gradle-7.1All versions (No fix recorded)
eco-java-gradle-7.1.1All versions (No fix recorded)
eco-java-gradle-7.2All versions (No fix recorded)
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded)

Show all 67

Oracle31 products

banking_apis≥ 18.1, ≤ 18.3 | 19.1 | 19.2 | 20.1 | 21.1
banking_digital_experience≥ 18.1, ≤ 18.3 | 19.1 | 19.2 | 20.1 | 21.1
banking_enterprise_default_management2.7.0
banking_party_management2.7.0
banking_payments14.5

Show all 31

Netapp2 products

Apache1 product

commons_compress≥ 1.0, < 1.21

Apache software foundation1 product

apache commons compress≥ Apache Commons Compress, ≤ 1.20

Debian1 product

libcommons-compress-java< 1.21-1

Org.apache.commons1 product

commons-compress< 1.21

Ubuntu1 product

libcommons-compress-javaAll versions (No fix recorded)

8 vendors · 105 products

References

65 links

commons.apache.org/proper/commons-compress/security-reports.htmlX Refsource MISCREPORTAdvisoryWEBVendor Advisory
lists.apache.org/thread.html/…X Refsource MISCREPORTAdvisoryWEBVendor Advisory
www.openwall.com/lists/oss-security/2021/07/13/4Mailing ListX Refsource MLISTREPORTAdvisoryWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.openwall.com/lists/oss-security/2021/07/13/6Mailing ListX Refsource MLISTREPORTAdvisoryWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB

Show all 65 references

lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com/security-alerts/cpuoct2021.htmlX Refsource MISCAdvisoryWEBThird Party Advisory
www.oracle.com/security-alerts/cpujan2022.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
security.netapp.com/advisory/ntap-20211022-0001/X Refsource CONFIRMAdvisoryThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpujul2022.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
ubuntu.com/security/CVE-2021-36090REPORT
www.openwall.com/lists/oss-security/2021/07/13/4REPORT
lists.apache.org/thread.html/…REPORTWEB
lists.apache.org/thread.html/…REPORTWEB
lists.apache.org/thread.html/…REPORTWEB
www.cve.org/CVERecord?id=CVE-2021-36090REPORT
security-tracker.debian.org/tracker/CVE-2021-36090Advisory
nvd.nist.gov/vuln/detail/CVE-2021-36090Advisory
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
security.netapp.com/advisory/ntap-20211022-0001WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities