CVE-2024-25710 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

What is CVE-2024-25710?

CVE-2024-25710 is a high-severity denial of service vulnerability in Apache Commons Compress, published on 19 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Weakness: CWE-835

Which versions are affected by CVE-2024-25710?

2 open source packages ship an affected version, including org.apache.commons:commons-compress. It affects 1 product.

Products include Apache Commons Compress.

How do I fix CVE-2024-25710?

Upgrade org.apache.commons:commons-compress to 1.26.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-25710 being exploited?

There is no known exploitation of CVE-2024-25710 in the wild and no public exploit code.

Other vulnerabilities in Apache Commons Compress

• CVE-2021-35515 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability High 7.5
• CVE-2021-35516 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability High 7.5
• CVE-2021-35517 Apache Commons Compress 1.1 to 1.20 denial of service vulnerability High 7.5
• CVE-2021-36090 Apache Commons Compress 1.0 to 1.20 denial of service vulnerability High 7.5
• CVE-2019-12402 Denial of Service in Apache Commons Compress High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-34812, AZL-43564, AZL-44916, CLEANSTART-2026-HE16906, CLEANSTART-2026-SD55933, CLSA-2026-1787323198 and 19 more.