Denial of Service Vulnerability in libcommons-compress-java: Memory Allocation Issue
Summary
CVE-2021-35517: When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. Affects libcommons-compress-java versions >= 9ee24a3d6a84c7e09abb5a9b4940bc91e2ab23d6, <= f7503adfbad8b44eb079d564f2784aeaa034647c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libcommons-compress-java is a Java library that provides support for reading and writing various compression formats, including TAR archives. It is widely used in applications that require file compression and decompression functionalities. However, this library has a vulnerability that can lead to excessive memory allocation when processing specially crafted TAR files, potentially causing applications to crash or become unresponsive.
Vulnerability Detail
The vulnerability, identified as CVE-2021-35517, arises when the Compress library processes a specially crafted TAR archive. This can lead to the allocation of large amounts of memory, resulting in an out-of-memory error even with small inputs. The potential ramifications include denial of service attacks against services utilizing the Compress library's TAR package, making it a critical issue for applications relying on this library.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation to restrict the types of TAR files that can be processed by the application. This may involve checking the size and structure of the TAR files before processing them.
Conclusion
CVE-2021-35517 is a significant vulnerability in the libcommons-compress-java library that can lead to denial of service attacks through excessive memory allocation. It is crucial for users of this library to update to the latest version to mitigate the risk. Additionally, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for libcommons-compress-java →
FAQ
CVE-2021-35517 is a vulnerability in the libcommons-compress-java library that allows for denial of service attacks due to excessive memory allocation when processing specially crafted TAR files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2021-35517 is 7.5, indicating a high severity level.
The primary impact is a denial of service, where applications may crash or become unresponsive due to excessive memory usage when processing malicious TAR files.
Yes, updating to version 1.21-1 or later of libcommons-compress-java addresses this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
