CVE-2021-36373: Apache Ant
Medium severity, CVSS 5.5. EPSS: 2.5% chance of exploitation in the next 30 days.
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Affected products
- Apache Ant: from 1.9.0, before 1.9.16 (fixed in 1.9.16); from 1.10.0, before 1.10.11 (fixed in 1.10.11)
- Oracle Agile Product Lifecycle Management: version 9.3.6 only
- Oracle Banking Trade Finance: version 14.5 only
- Oracle Banking Treasury Management: version 14.5 only
- Oracle Communications Cloud Native Core Automated Test Suite: version 1.9.0 only
- Oracle Communications Cloud Native Core Binding Support Function: version 1.11.0 only
- Oracle Communications Order And Service Management: version 7.3 only; version 7.4 only
- Oracle Communications Unified Inventory Management: version 7.3.0 only; version 7.4.0 only; version 7.4.1 only; version 7.4.2 only; version 7.5.0 only
- Oracle Enterprise Repository: version 11.1.1.7.0 only
- Oracle Financial Services Analytical Applications Infrastructure: from 8.0.6, up to and including 8.1.1
- Oracle Insurance Policy Administration: from 11.0, up to and including 11.3.1
- Oracle Primavera Gateway: from 17.12.0, up to and including 17.12.11; from 18.8.0, up to and including 18.8.12; from 19.12.0, up to and including 19.12.11; from 20.12.0, up to and including 20.12.7
- Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only
- Oracle Real-Time Decision Server: version 3.2.0.0 only; version 11.1.1.9.0 only
- Oracle Retail Advanced Inventory Planning: version 14.1 only; version 15.0 only; version 16.0 only
- Oracle Retail Back Office: version 14.0 only; version 14.1 only
- Oracle Retail Bulk Data Integration: version 16.0.3.0 only; version 19.0.1 only
- Oracle Retail Central Office: version 14.0 only; version 14.1 only
- Oracle Retail Eftlink: version 19.0.1 only; version 20.0.1 only
- Oracle Retail Extract Transform And Load: version 13.2.8 only
- Oracle Retail Financial Integration: version 14.1.3.2 only; version 15.0.4.0 only; version 16.0.3.0 only
- Oracle Retail Integration Bus: version 14.1.3.2 only; version 15.0.4.0 only; version 16.0.3.0 only; version 19.0.1.0 only
- Oracle Retail Invoice Matching: version 16.0.3 only
- Oracle Retail Merchandising System: version 19.0.1 only
- Oracle Retail Point-Of-Service: version 14.0 only; version 14.1 only
- and 7 more
Published 2021-07-14. Last modified 2026-08-25.