CVE-2024-25710highCWE-835

CVE-2024-25710: high-severity vulnerability in Apache Commons Compress

Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

Published · Updated

Follow this CVE+ Monitor Apache Commons Compress+ Monitor libcommons-compress-java

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.4%
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Commons Compress
Related CVEs — Apache Commons Compress

In the same product, most dangerous first.

CVE-2019-12402—CVE-2019-12402EPSS 16.2%CVE-2021-36090—Apache Commons Compress 1.0 to 1.20 denial of service vulnerabilityEPSS 12.9%CVE-2021-35516—Apache Commons Compress 1.6 to 1.20 denial of service vulnerabilityEPSS 12.4%CVE-2021-35515—Apache Commons Compress 1.6 to 1.20 denial of service vulnerabilityEPSS 11.6%CVE-2021-35517—Apache Commons Compress 1.1 to 1.20 denial of service vulnerabilityEPSS 10.6%CVE-2018-11771—CVE-2018-11771EPSS 5.3%