CVE-2021-36090: Improper Handling of Length Parameter Inconsistency in Compress
Summary
CVE-2021-36090: Improper Handling of Length Parameter Inconsistency in Compress. Affects org.apache.commons:commons-compress versions < 1.21. Fixed in 1.21. How to fix ↓
Also tracked for
- libcommons-compress-java · Debian:11
The same CVE-2021-36090 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is org.apache.commons:commons-compress, which is a popular open-source library for working with various compression and archive formats in the Maven ecosystem. It provides functionality for creating, reading, and manipulating ZIP archives. However, a vulnerability has been discovered in the package that can lead to a denial of service attack when processing specially crafted ZIP archives.
Vulnerability Detail
The vulnerability arises from an improper handling of length parameter inconsistency in the Compress library. When a specially crafted ZIP archive is read, the library can be tricked into allocating excessive amounts of memory, resulting in an out of memory error. Even small inputs can trigger this issue, making it possible to mount a denial of service attack against services that utilize the Compress' zip package. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 1.28.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.21
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to the patched version of the org.apache.commons:commons-compress package.
Conclusion
In conclusion, the org.apache.commons:commons-compress package is vulnerable to an improper handling of length parameter inconsistency issue that can lead to a denial of service attack. It is crucial to upgrade to version 1.21 or later of the package to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.commons:commons-compress →
FAQ
The vulnerability can be exploited to mount a denial of service attack against services that use the affected Compress library. By sending specially crafted ZIP archives, an attacker can cause the targeted service to consume excessive memory, leading to an out of memory error and potential service disruption.
Versions prior to 1.21 of the org.apache.commons:commons-compress package are affected by this vulnerability.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is advisable to apply the fix promptly to mitigate any potential risks.
The only effective mitigation is to upgrade to version 1.21 or later of the org.apache.commons:commons-compress package. It is crucial to keep all dependencies up to date to ensure the security of the software.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-mc84-pj99-q6hh/GHSA-mc84-pj99-q6hh.json
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.commons:commons-compress.
