CVE-2021-35515: Apache Commons Compress
High severity, CVSS 7.5. EPSS: 11.6% chance of exploitation in the next 30 days.
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Affected products
- Apache Commons Compress: from 1.6, up to and including 1.20
- Netapp Active Iq Unified Manager: affected versions not specified
- Netapp Oncommand Insight: affected versions not specified
- Oracle Banking Digital Experience: from 18.1, up to and including 18.3; version 19.1 only; version 20.1 only; version 21.1 only
- Oracle Banking Enterprise Default Management: version 2.7.0 only
- Oracle Banking Party Management: version 2.7.0 only
- Oracle Banking Payments: version 14.5 only
- Oracle Banking Trade Finance: version 14.5 only
- Oracle Banking Treasury Management: version 14.5 only
- Oracle Business Process Management Suite: version 12.2.1.3.0 only; version 12.2.1.4.0 only
- Oracle Commerce Guided Search: version 11.3.2 only
- Oracle Communications Billing And Revenue Management: version 12.0.0.4 only
- Oracle Communications Cloud Native Core Automated Test Suite: version 1.8.0 only
- Oracle Communications Cloud Native Core Service Communication Proxy: version 1.14.0 only
- Oracle Communications Cloud Native Core Unified Data Repository: version 1.14.0 only
- Oracle Communications Diameter Intelligence Hub: from 8.0.0, up to and including 8.2.3
- Oracle Communications Messaging Server: version 8.1 only
- Oracle Communications Session Route Manager: from 8.0.0, up to and including 8.2.5
- Oracle Financial Services Crime And Compliance Management Studio: version 8.0.8.2.0 only; version 8.0.8.3.0 only
- Oracle Financial Services Enterprise Case Management: version 8.0.7.2.0 only; version 8.0.8.1.0 only
- Oracle Flexcube Universal Banking: from 14.0.0, up to and including 14.3.0; version 12.4.0 only; version 14.5.0 only
- Oracle Healthcare Data Repository: version 8.1.0 only
- Oracle Insurance Policy Administration: version 11.0.2 only; version 11.1.0 only; version 11.2.8 only; version 11.3.0 only; version 11.3.1 only
- Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
- Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only
- and 1 more
Published 2021-07-13. Last modified 2026-06-17.