CVE-2021-35515 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
Attackers can cause a denial of service via infinite loop when processing crafted 7Z archives using Apache Commons Compress.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-35515?
CVE-2021-35515 is a high-severity denial of service vulnerability in Netapp Active Iq Unified Manager, published on 13 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Which versions are affected by CVE-2021-35515?
2 open source packages ship an affected version, including org.apache.commons:commons-compress. It affects 26 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.commons:commons-compress Maven | All versions | 1.21 |
org.apache.commons:commons-compress Maven | All versions | 1.21 |
Products include Apache Commons Compress, Netapp Active Iq Unified Manager, Netapp Oncommand Insight, Oracle Banking Digital Experience, Oracle Banking Enterprise Default Management, Oracle Banking Party Management and 20 more.
How do I fix CVE-2021-35515?
Upgrade org.apache.commons:commons-compress to 1.21 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-35515 being exploited?
There is no known exploitation of CVE-2021-35515 in the wild and no public exploit code.
Other vulnerabilities in Netapp Active Iq Unified Manager
- CVE-2024-25710 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
- CVE-2021-35516 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
- CVE-2021-35517 Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
- CVE-2021-36090 Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
- CVE-2019-12402 Denial of Service in Apache Commons Compress
Sources
Also known as AZL-45081, CLSA-2026-1767917314, CLSA-2026-1784250509, CLSA-2026-1784769559, DEBIAN-CVE-2021-35515, GHSA-7hfm-57qf-j43q and 3 more.