The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with speci

Summary

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

Timeline

1. Aug 29, 2019, 12:00 AM UTCCVE published
2. Aug 4, 2024, 11:17 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Commons Compress

  1.15 to 1.18

• org.apache.commons:commons-compressMaven

  From 1.15 · fixed in 1.19

• io.github.1tchy.java9modular.org.apache.commons:commons-compressMaven

  1.18.1

References 25