CVE-2021-35515CWE-834

Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

published July 13, 2021

CVSS
—
EPSS
12%
Percentile
96.0
In the wild
Unconfirmed
What it is

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.11567 · 96.0th percentile
Weakness
CWE-834 · Excessive Iteration
Published
2021-07-13T07:15Z
EPSS history
Timeline
  • 13 JUL 07:15Z
    Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
    cvelistv5