CVE-2021-36374
MediumCVSS 5.5Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
When reading a specially crafted ZIP archive or derived formats, an Apache Ant build can be made to allocate large amounts of memory, leading to an out-of-memory error even for small inputs. This can disrupt builds using Apache Ant. Versions prior to 1.9.16 and 1.10.11 are affected.
Risk Assessment
An attacker can disrupt the software build process, causing failures or unavailability of CI/CD environments, potentially delaying releases and impacting service availability.
Recommendation
Update Apache Ant to version 1.9.16, 1.10.11, or later to avoid excessive memory consumption.
Other vulnerabilities in Apache Ant
See all- CVE-2026-78254Unknown
The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18.
- CVE-2021-36373Medium
When reading a specially crafted TAR archive, an Apache Ant build can be made to allocate large amounts of memory, leading to an out-of-memory error even for small inputs. This can disrupt builds using Apache Ant. Versions prior to 1.9.16 and 1.10.11 are affected.
Original NVD description (English source)
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.