High
libcommons-compress-java — security advisory
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
- Products
- libcommons-compress-java
- Affected versions
- 1.10-1, 1.10-2, 1.13-1, 1.13-2, 1.18-1~18.04, 1.18-3, 1.19-1, 1.20-1, 1.21-1, 1.23.0-1, 1.24.0-1, 1.25.0-1, 1.27.1-2, 1.9-1
- Fixed versions
- Not specified
- CVEs
- CVE-2021-36090
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:59 UTC · Revision 1
Source evidence
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
osv:UBUNTU-CVE-2021-36090
libcommons-compress-java
Fixed versions: Not specified
libcommons-compress-java
Fixed versions: Not specified
libcommons-compress-java
Fixed versions: Not specified
libcommons-compress-java
Fixed versions: Not specified
libcommons-compress-java
Fixed versions: Not specified
libcommons-compress-java
Fixed versions: Not specified
libcommons-compress-java
Fixed versions: Not specified
libcommons-compress-java
Fixed versions: Not specified
Complete source record
{
"id": "e475d9a0dbca857126ec367dc90f53c2911c50ae2de069d0d554d6d05bbf9447",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-36090",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2021-36090",
"summary": "When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.",
"evidence": "osv:UBUNTU-CVE-2021-36090",
"products": [
{
"name": {
"value": "libcommons-compress-java",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.9-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.10-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.10-2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "libcommons-compress-java",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.13-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.13-2",
"evidence": "/affected/1/versions"
},
{
"value": "1.18-1~18.04",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "libcommons-compress-java",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.18-3",
"evidence": "/affected/2/versions"
},
{
"value": "1.19-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "libcommons-compress-java",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.20-1",
"evidence": "/affected/3/versions"
},
{
"value": "1.21-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "libcommons-compress-java",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.23.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "1.24.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "1.25.0-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "libcommons-compress-java",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.27.1-2",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "libcommons-compress-java",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.27.1-2",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "libcommons-compress-java",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.27.1-2",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2021-36090",
"aliases": [
"UBUNTU-CVE-2021-36090"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcommons-compress-java",
"purl": "pkg:deb/ubuntu/libcommons-compress-java?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.9-1",
"1.10-1",
"1.10-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-36090.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-compress-java",
"binary_version": "1.10-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcommons-compress-java",
"purl": "pkg:deb/ubuntu/libcommons-compress-java?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.13-1",
"1.13-2",
"1.18-1~18.04"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-36090.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-compress-java",
"binary_version": "1.18-1~18.04"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcommons-compress-java",
"purl": "pkg:deb/ubuntu/libcommons-compress-java?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.18-3",
"1.19-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-36090.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-compress-java",
"binary_version": "1.19-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcommons-compress-java",
"purl": "pkg:deb/ubuntu/libcommons-compress-java?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.20-1",
"1.21-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-36090.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-compress-java",
"binary_version": "1.21-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcommons-compress-java",
"purl": "pkg:deb/ubuntu/libcommons-compress-java?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.23.0-1",
"1.24.0-1",
"1.25.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-36090.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-compress-java",
"binary_version": "1.25.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcommons-compress-java",
"purl": "pkg:deb/ubuntu/libcommons-compress-java?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.27.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-36090.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-compress-java",
"binary_version": "1.27.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcommons-compress-java",
"purl": "pkg:deb/ubuntu/libcommons-compress-java?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.27.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-36090.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-compress-java",
"binary_version": "1.27.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcommons-compress-java",
"purl": "pkg:deb/ubuntu/libcommons-compress-java?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.27.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-36090.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcommons-compress-java",
"binary_version": "1.27.1-2"
}
]
}
}
],
"modified": "2026-10-17T12:56:20.463935931Z",
"provider": "osv",
"upstream": [
"CVE-2021-36090"
],
"references": [
"https://ubuntu.com/security/CVE-2021-36090",
"https://www.openwall.com/lists/oss-security/2021/07/13/4",
"https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E",
"https://commons.apache.org/proper/commons-compress/security-reports.html",
"https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53@%3Cannounce.apache.org%3E",
"https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38@%3Cuser.ant.apache.org%3E",
"https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9@%3Cannounce.apache.org%3E",
"https://www.cve.org/CVERecord?id=CVE-2021-36090"
]
},
"related_cves": [
{
"value": "CVE-2021-36090",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 355329,
"published_at": "2021-07-13T08:15:00+00:00"
}