CVE-2024-25710: apache software foundation apache commons compress Infinite Loop

CVSS: 8.1v3.1HighModified

AliasesUBUNTU-CVE-2024-25710DEBIAN-CVE-2024-25710CGA-22m3-rrwq-jrm7+470 more

Published 19-02-2024Last modified 04-11-2025

Vulnerability summary

CVE-2024-25710 is a high (CVSS 8.1) Infinite Loop vulnerability in apache software foundation apache commons compress. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.9% of scored vulnerabilities.

Overall risk

32/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.1/10

010

High · v3.1 (CVE.org)

EPSS score

0.44%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 14

OPENSUSE-SU-2024:13702-1 SUSE-SU-2024:0726-1 CGA-2XG7-8QM4-VX87 CGA-3WH2-6F5W-RXM4 CGA-679F-CJH5-5F6Q CGA-86RR-9236-XPQ3+8 more

Timeline

19-02-2024
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

CVSS metrics

7 scores · 7 sources · 1 version

v3.18.1

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

0.00 pp

From 0.44% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected systems

Chainguard198 products

celeborn-0.5< 0.5.4-r26
celeborn-0.6< 0.6.3-r7
dependency-track< 4.10.1-r2
dependency-track-bundled< 4.10.1-r2
druid< 37.0.0-r14 | < 34.0.0-r6 | < 37.0.0-r56

eco-java-gradle-4.10All versions (No fix recorded)
eco-java-gradle-4.10.1All versions (No fix recorded)
eco-java-gradle-4.10.2All versions (No fix recorded)
eco-java-gradle-4.10.3All versions (No fix recorded)
eco-java-gradle-4.2All versions (No fix recorded)
eco-java-gradle-4.2.1All versions (No fix recorded)
eco-java-gradle-4.3All versions (No fix recorded)
eco-java-gradle-4.3.1All versions (No fix recorded)
eco-java-gradle-4.4All versions (No fix recorded)
eco-java-gradle-4.4.1All versions (No fix recorded)
eco-java-gradle-4.5All versions (No fix recorded)
eco-java-gradle-4.5.1All versions (No fix recorded)
eco-java-gradle-4.6All versions (No fix recorded)
eco-java-gradle-4.7All versions (No fix recorded)
eco-java-gradle-4.8All versions (No fix recorded)
eco-java-gradle-4.8.1All versions (No fix recorded)
eco-java-gradle-4.9All versions (No fix recorded)
eco-java-gradle-5.0All versions (No fix recorded)
eco-java-gradle-5.1All versions (No fix recorded)
eco-java-gradle-5.1.1All versions (No fix recorded)
eco-java-gradle-5.2All versions (No fix recorded)
eco-java-gradle-5.2.1All versions (No fix recorded)
eco-java-gradle-5.3All versions (No fix recorded)
eco-java-gradle-5.3.1All versions (No fix recorded)
eco-java-gradle-5.4All versions (No fix recorded)
eco-java-gradle-5.4.1All versions (No fix recorded)
eco-java-gradle-5.5All versions (No fix recorded)
eco-java-gradle-5.5.1All versions (No fix recorded)
eco-java-gradle-5.6All versions (No fix recorded)
eco-java-gradle-5.6.1All versions (No fix recorded)
eco-java-gradle-5.6.2All versions (No fix recorded)
eco-java-gradle-5.6.3All versions (No fix recorded)
eco-java-gradle-5.6.4All versions (No fix recorded)
eco-java-gradle-6.0All versions (No fix recorded)
eco-java-gradle-6.0.1All versions (No fix recorded)
eco-java-gradle-6.1All versions (No fix recorded)
eco-java-gradle-6.1.1All versions (No fix recorded)
eco-java-gradle-6.2All versions (No fix recorded)
eco-java-gradle-6.2.1All versions (No fix recorded)
eco-java-gradle-6.2.2All versions (No fix recorded)
eco-java-gradle-6.3All versions (No fix recorded)
eco-java-gradle-6.4All versions (No fix recorded)
eco-java-gradle-6.4.1All versions (No fix recorded)
eco-java-gradle-6.5All versions (No fix recorded)
eco-java-gradle-6.5.1All versions (No fix recorded)
eco-java-gradle-6.6All versions (No fix recorded)
eco-java-gradle-6.6.1All versions (No fix recorded)
eco-java-gradle-6.7All versions (No fix recorded)
eco-java-gradle-6.7.1All versions (No fix recorded)
eco-java-gradle-6.8All versions (No fix recorded)
eco-java-gradle-6.8.1All versions (No fix recorded)
eco-java-gradle-6.8.2All versions (No fix recorded)
eco-java-gradle-6.8.3All versions (No fix recorded)
eco-java-gradle-6.9All versions (No fix recorded)
eco-java-gradle-6.9.1All versions (No fix recorded)
eco-java-gradle-6.9.2All versions (No fix recorded)
eco-java-gradle-6.9.3All versions (No fix recorded)
eco-java-gradle-6.9.4All versions (No fix recorded)
eco-java-gradle-7.0All versions (No fix recorded)
eco-java-gradle-7.0.1All versions (No fix recorded)
eco-java-gradle-7.0.2All versions (No fix recorded)
eco-java-gradle-7.1All versions (No fix recorded)
eco-java-gradle-7.1.1All versions (No fix recorded)
eco-java-gradle-7.2All versions (No fix recorded)
eco-java-gradle-7.3All versions (No fix recorded)
eco-java-gradle-7.3.1All versions (No fix recorded)
eco-java-gradle-7.3.2All versions (No fix recorded)
eco-java-gradle-7.3.3All versions (No fix recorded)
eco-java-gradle-7.4All versions (No fix recorded)
eco-java-gradle-7.4.1All versions (No fix recorded)
eco-java-gradle-7.4.2All versions (No fix recorded)
eco-java-gradle-7.5All versions (No fix recorded)
eco-java-gradle-7.5.1All versions (No fix recorded)
eco-java-gradle-7.6All versions (No fix recorded)
eco-java-gradle-7.6.1All versions (No fix recorded)
eco-java-gradle-7.6.2All versions (No fix recorded)
eco-java-gradle-7.6.3All versions (No fix recorded)
eco-java-gradle-7.6.4All versions (No fix recorded)
eco-java-gradle-8.0All versions (No fix recorded)
eco-java-gradle-8.0.1All versions (No fix recorded)
eco-java-gradle-8.0.2All versions (No fix recorded)
eco-java-gradle-8.1All versions (No fix recorded)
eco-java-gradle-8.1.1All versions (No fix recorded)
eco-java-gradle-8.2All versions (No fix recorded)
eco-java-gradle-8.2.1All versions (No fix recorded)
eco-java-gradle-8.3All versions (No fix recorded)
eco-java-gradle-8.4All versions (No fix recorded)
eco-java-gradle-8.5All versions (No fix recorded)
eco-java-gradle-8.6All versions (No fix recorded)
eco-java-gradle-8.7All versions (No fix recorded)
gradle-8< 8.7.0-r1
gradle-stage0All versions (No fix recorded)
hadoop-client-modules< 3.3.6-r2
hadoop-fips-3.3.6< 3.3.6-r22 | All versions (No fix recorded)
hadoop-fips-3.4.2< 3.4.2-r1 | All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded)
kayenta-2026.1< 2026.1.0-r1
kayenta-fips-2026.1< 2026.1.0-r1
opensearch-2< 2.12.0-r1
opensearch-2-alerting< 2.12.0-r1
opensearch-2-analysis-icu< 2.12.0-r1
opensearch-2-analysis-kuromoji< 2.12.0-r1
opensearch-2-analysis-nori< 2.12.0-r1
opensearch-2-analysis-phonetic< 2.12.0-r1
opensearch-2-analysis-smartcn< 2.12.0-r1
opensearch-2-analysis-stempel< 2.12.0-r1
opensearch-2-analysis-ukrainian< 2.12.0-r1
opensearch-2-anomaly-detection< 2.12.0-r1
opensearch-2-asynchronous-search< 2.12.0-r1
opensearch-2-cross-cluster-replication< 2.12.0-r1
opensearch-2-crypto-kms< 2.12.0-r1
opensearch-2-custom-codecs< 2.12.0-r1
opensearch-2-discovery-azure-classic< 2.12.0-r1
opensearch-2-discovery-ec2< 2.12.0-r1
opensearch-2-discovery-gce< 2.12.0-r1
opensearch-2-entrypoint-compat< 2.12.0-r1
opensearch-2-geospatial< 2.12.0-r1
opensearch-2-identity-shiro< 2.12.0-r1
opensearch-2-index-management< 2.12.0-r1
opensearch-2-ingest-attachment< 2.12.0-r1
opensearch-2-job-scheduler< 2.12.0-r1
opensearch-2-k-nn< 2.12.0-r1
opensearch-2-mapper-annotated-text< 2.12.0-r1
opensearch-2-mapper-murmur3< 2.12.0-r1
opensearch-2-mapper-size< 2.12.0-r1
opensearch-2-ml-commons< 2.12.0-r1
opensearch-2-neural-search< 2.12.0-r1
opensearch-2-notifications< 2.12.0-r1
opensearch-2-observability< 2.12.0-r1
opensearch-2-performance-analyzer< 2.12.0-r1
opensearch-2-reporting< 2.12.0-r1
opensearch-2-repository-azure< 2.12.0-r1
opensearch-2-repository-gcs< 2.12.0-r1
opensearch-2-repository-s3< 2.12.0-r1
opensearch-2-security< 2.12.0-r1
opensearch-2-security-analytics< 2.12.0-r1
opensearch-2-sql< 2.12.0-r1
opensearch-2-store-smb< 2.12.0-r1
opensearch-2-telemetry-otel< 2.12.0-r1
opensearch-2-transport-nio< 2.12.0-r1
rangerAll versions (No fix recorded)
spark-3.5-scala-2.12All versions (No fix recorded)
spark-3.5-scala-2.13All versions (No fix recorded)
spark-fips-3.5-scala-2.12All versions (No fix recorded)
spark-fips-3.5-scala-2.13All versions (No fix recorded)
spdx-tools-java< 1.1.8-r1
tez< 0.10.4-r6
trino< 439-r2
trino-config< 439-r2
trino-oci-entrypoint< 439-r2
trino-plugin-ai-functions< 439-r2
trino-plugin-bigquery< 439-r2
trino-plugin-blackhole< 439-r2
trino-plugin-cassandra< 439-r2
trino-plugin-clickhouse< 439-r2
trino-plugin-delta-lake< 439-r2
trino-plugin-druid< 439-r2
trino-plugin-duckdb< 439-r2
trino-plugin-elasticsearch< 439-r2
trino-plugin-exasol< 439-r2
trino-plugin-exchange-filesystem< 439-r2
trino-plugin-exchange-hdfs< 439-r2
trino-plugin-faker< 439-r2
trino-plugin-functions-python< 439-r2
trino-plugin-geospatial< 439-r2
trino-plugin-google-sheets< 439-r2
trino-plugin-hive< 439-r2
trino-plugin-http-event-listener< 439-r2
trino-plugin-http-server-event-listener< 439-r2
trino-plugin-hudi< 439-r2
trino-plugin-iceberg< 439-r2
trino-plugin-ignite< 439-r2
trino-plugin-jmx< 439-r2
trino-plugin-kafka< 439-r2
trino-plugin-kafka-event-listener< 439-r2
trino-plugin-lakehouse< 439-r2
trino-plugin-ldap-group-provider< 439-r2
trino-plugin-loki< 439-r2
trino-plugin-mariadb< 439-r2
trino-plugin-memory< 439-r2
trino-plugin-ml< 439-r2
trino-plugin-mongodb< 439-r2
trino-plugin-mysql< 439-r2
trino-plugin-mysql-event-listener< 439-r2
trino-plugin-opa< 439-r2
trino-plugin-openlineage< 439-r2
trino-plugin-opensearch< 439-r2
trino-plugin-oracle< 439-r2
trino-plugin-password-authenticators< 439-r2
trino-plugin-pinot< 439-r2
trino-plugin-postgresql< 439-r2
trino-plugin-prometheus< 439-r2
trino-plugin-ranger< 439-r2

Show all 198

Apache1 product

commons_compress≥ 1.3, < 1.26.0

Apache software foundation1 product

apache commons compress≥ 1.3, ≤ 1.25.0

3 vendors · 200 products · Showing 200 of 292. Use Open JSON for the complete list.

References

13 links

lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kfVendor AdvisoryREPORTAdvisoryWEB
www.openwall.com/lists/oss-security/2024/02/19/1REPORTWEBMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20240307-0010/Advisory
seclists.org/fulldisclosure/2024/Aug/37WEB
ubuntu.com/security/CVE-2024-25710REPORT
www.openwall.com/lists/oss-security/2024/02/19/1REPORT
www.cve.org/CVERecord?id=CVE-2024-25710REPORT
security-tracker.debian.org/tracker/CVE-2024-25710Advisory
repo.maven.apache.org/maven2/WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25710.jsonAdvisory

Show all 13 references

nvd.nist.gov/vuln/detail/CVE-2024-25710AdvisoryOval
github.com/apache/commons-compressPACKAGE
security.netapp.com/advisory/ntap-20240307-0010WEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities