CVE-2021-35517: Apache Commons Compress

High severity, CVSS 7.5. EPSS: 10.6% chance of exploitation in the next 30 days.

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

Affected products

Apache Commons Compress: from 1.1, up to and including 1.20
Netapp Active Iq Unified Manager: affected versions not specified
Netapp Oncommand Insight: affected versions not specified
Oracle Banking Apis: from 18.1, up to and including 18.3; version 19.1 only; version 19.2 only; version 20.1 only; version 21.1 only
Oracle Banking Digital Experience: from 18.1, up to and including 18.3; version 19.1 only; version 19.2 only; version 20.1 only; version 21.1 only
Oracle Banking Enterprise Default Management: version 2.7.0 only
Oracle Banking Party Management: version 2.7.0 only
Oracle Banking Payments: version 14.5 only
Oracle Banking Trade Finance: version 14.5 only
Oracle Banking Treasury Management: version 14.5 only
Oracle Business Process Management Suite: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Commerce Guided Search: version 11.3.2 only
Oracle Communications Billing And Revenue Management: version 12.0.0.4 only
Oracle Communications Cloud Native Core Service Communication Proxy: version 1.14.0 only
Oracle Communications Cloud Native Core Unified Data Repository: version 1.14.0 only
Oracle Communications Diameter Intelligence Hub: from 8.0.0, up to and including 8.2.3
Oracle Communications Messaging Server: version 8.1 only
Oracle Communications Session Route Manager: from 8.0.0, up to and including 8.2.5
Oracle Financial Services Crime And Compliance Management Studio: version 8.0.8.2.0 only; version 8.0.8.3.0 only
Oracle Financial Services Enterprise Case Management: version 8.0.7.2.0 only; version 8.0.8.1.0 only
Oracle Flexcube Universal Banking: from 14.0.0, up to and including 14.3.0; version 12.4 only; version 14.5 only
Oracle Healthcare Data Repository: version 8.1.0 only
Oracle Insurance Policy Administration: version 11.0.2 only; version 11.1.0 only; version 11.2.8 only; version 11.3.0 only; version 11.3.1 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only
and 2 more

Published 2021-07-13. Last modified 2026-10-08.