CVE-2018-11771

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF…

published August 16, 2018

CVSS
—
EPSS
5%
Percentile
92.5
In the wild
Unconfirmed
What it is

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05253 · 92.5th percentile
Published
2018-08-16T15:00Z
EPSS history
Timeline
  • 16 AUG 15:00Z
    When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF…
    cvelistv5