CVE-2021-36373
MediumCVSS 5.5Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
When reading a specially crafted TAR archive, an Apache Ant build can be made to allocate large amounts of memory, leading to an out-of-memory error even for small inputs. This can disrupt builds using Apache Ant. Versions prior to 1.9.16 and 1.10.11 are affected.
Risk Assessment
An attacker can disrupt the software build process, causing failures or unavailability of CI/CD environments, potentially delaying releases and impacting service availability.
Recommendation
Update Apache Ant to version 1.9.16, 1.10.11, or later to avoid excessive memory consumption.
Other vulnerabilities in Apache Ant
See all- CVE-2026-78254Unknown
The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18.
- CVE-2021-36374Medium
When reading a specially crafted ZIP archive or derived formats, an Apache Ant build can be made to allocate large amounts of memory, leading to an out-of-memory error even for small inputs. This can disrupt builds using Apache Ant. Versions prior to 1.9.16 and 1.10.11 are affected.
Original NVD description (English source)
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.