Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

Summary

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Timeline

1. Jul 13, 2021, 7:15 AM UTCCVE published
2. Aug 4, 2024, 12:40 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Commons Compress

  From 1.6

• org.apache.commons:commons-compressMaven

  fixed in 1.21

References 21