CVE-2021-36374: Apache Ant

Medium severity, CVSS 5.5. EPSS: 2.6% chance of exploitation in the next 30 days.

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Affected products

Apache Ant: from 1.9.0, before 1.9.16 (fixed in 1.9.16); from 1.10.0, before 1.10.11 (fixed in 1.10.11)
Oracle Agile Engineering Data Management: version 6.2.1.0 only
Oracle Agile Product Lifecycle Management: version 9.3.6 only
Oracle Banking Trade Finance: version 14.5 only
Oracle Banking Treasury Management: version 14.5 only
Oracle Communications Cloud Native Core Automated Test Suite: version 1.9.0 only
Oracle Communications Cloud Native Core Binding Support Function: version 1.11.0 only
Oracle Communications Diameter Intelligence Hub: from 8.0.0, up to and including 8.1.0; from 8.2.0, up to and including 8.2.3
Oracle Communications Order And Service Management: version 7.3 only; version 7.4 only
Oracle Communications Unified Inventory Management: version 7.3.0 only; version 7.4.0 only; version 7.4.1 only; version 7.4.2 only; version 7.5.0 only
Oracle Enterprise Repository: version 11.1.1.7.0 only
Oracle Financial Services Analytical Applications Infrastructure: from 8.0.6, up to and including 8.1.1
Oracle Health Sciences Information Manager: from 3.0.1, up to and including 3.0.5; version 3.0.0.1 only
Oracle Insurance Policy Administration: from 11.0, up to and including 11.3.1
Oracle Primavera Gateway: from 17.12.0, up to and including 17.12.11; from 18.8.0, up to and including 18.8.12; from 19.12.0, up to and including 19.12.11; from 20.12.0, up to and including 20.12.7
Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only
Oracle Product Lifecycle Analytics: version 3.6.1 only
Oracle Real-Time Decision Server: version 3.2.0.0 only; version 11.1.1.9.0 only
Oracle Retail Advanced Inventory Planning: version 14.1 only; version 15.0 only; version 16.0 only
Oracle Retail Back Office: version 14.0 only; version 14.1 only
Oracle Retail Bulk Data Integration: version 16.0.3.0 only; version 19.0.1 only
Oracle Retail Central Office: version 14.0 only; version 14.1 only
Oracle Retail Eftlink: version 19.0.1 only; version 20.0.1 only
Oracle Retail Extract Transform And Load: version 13.2.8 only
Oracle Retail Financial Integration: version 14.1.3.2 only; version 15.0.4.0 only; version 16.0.3.0 only
and 11 more

Published 2021-07-14. Last modified 2026-08-25.