Denial of Service Vulnerability in libcommons-compress-java: Memory Allocation Issue
Summary
CVE-2021-35516: When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Affects libcommons-compress-java versions >= c49e865f4eabd47e264063499e27e12eb549feb1, <= f7503adfbad8b44eb079d564f2784aeaa034647c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcommons-compress-java is a Java library that provides support for reading and writing various compression formats, including 7Z, ZIP, and TAR. It is widely used in applications that require file compression and decompression functionalities. The library is designed to handle large files efficiently, but it has a vulnerability that can be exploited to cause excessive memory allocation, leading to denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2021-35516, arises when the Compress library processes specially crafted 7Z archives. Attackers can exploit this flaw to trigger large memory allocations, resulting in an out-of-memory error even when processing small inputs. This can effectively disrupt services that rely on the Compress library, making them unavailable to legitimate users. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to restrict the types of 7Z archives that can be processed by your application. This can help mitigate the risk of exploitation until the library is updated.
Conclusion
CVE-2021-35516 is a significant vulnerability in the libcommons-compress-java library that can lead to denial of service through excessive memory allocation. It is crucial to update the library to the latest version to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for libcommons-compress-java →
FAQ
CVE-2021-35516 is a vulnerability in the libcommons-compress-java library that allows attackers to exploit memory allocation issues when processing specially crafted 7Z archives.
Exploitation of this vulnerability can lead to denial of service, making your application unavailable to users due to excessive memory consumption.
The CVSS score of CVE-2021-35516 is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Implement input validation to restrict the types of 7Z archives processed by your application as a temporary workaround until you can upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
