CVE-2021-35517

HighCVSS 7.5

Published: 13/07/2021(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

10.61%

96th percentile - higher than 96% of all known CVEs

Summary

When reading a specially crafted TAR archive, Compress can allocate large amounts of memory, leading to an out-of-memory error even for very small inputs. This can be used to mount a denial of service attack against services using Compress' tar package.

Risk Assessment

An attacker can cause service unavailability by exhausting server memory.

Recommendation

Update the Compress library to a version that includes a fix limiting memory allocation.

Other vulnerabilities in Apache Commons Compress

CVE-2021-36090High
When reading a specially crafted ZIP archive, Compress can allocate large amounts of memory, leading to an out-of-memory error even for very small inputs. This can be used to mount a denial of service attack against services using Compress' zip package.

Original NVD description (English source)

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS