VDB
GHSA-6fxm-66hq-fc96
GHSA-6fxm-66hq-fc96
PUBLISHED
CVSS 9.199999809265137 CRITICAL
Uncontrolled Resource Consumption in Apache Commons Compress
Record from GitHub Advisory Database · Published May 13, 2022
commons-compress is fixed in 1.4.1 (Maven Central)
Uncontrolled Resource Consumption in Apache Commons Compress
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| org.apache.commons:commons-compress | Maven Central | 1.4.1 |
Risk scores
CVSS 4.0
9.199999809265137
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Maven | org.apache.commons:commons-compress | 0 |
Timeline
- May 13, 2022 CVE Published
- May 1, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-6fxm-66hq-fc96
vulnetix vdb fixes GHSA-6fxm-66hq-fc96Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-6fxm-66hq-fc96/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/apache/commons-compress/commit/8f702469cbf4c451b6dea349290bc4af0f6f76c7 url
- https://github.com/apache/commons-compress/commit/cca0e6e5341aacddefd4c4d36cef7cbdbc2a8777 url
- https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@<solr-user.lucene.apache.org> url
- http://packetstormsecurity.org/files/113014/Apache-Commons-Compress-Apache-Ant-Denial-Of-Service.html url
- https://github.com/apache/commons-compress/commit/020c03d8ef579e80511023fb46ece30e9c3dd27d url
- https://github.com/apache/commons-compress/commit/b06f7b41c936ef1a79589d16ea5c1d8b93f71f66 url
- https://github.com/apache/commons-compress/commit/ea31005111f0abede7e43e4ba0012e62e0808b22 url
- https://web.archive.org/web/20200517014414/http://www.securitytracker.com/id?1027096 url
- https://web.archive.org/web/20130525085523/http://www.securityfocus.com/bid/53676 url
- https://github.com/apache/commons-compress package
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75857 url
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105049.html url
- https://github.com/apache/commons-compress/commit/654222e628097763ee6ca561ae77be5c06666173 url
- https://github.com/apache/commons-compress/commit/6ced422bf5eca3aac05396367bafb33ec21bf74e url
- https://github.com/apache/commons-compress/commit/6e95697e783767f3549f00d7d2e1b002eac4a3d4 url
- https://github.com/apache/commons-compress/commit/fdd7459bc5470e90024dbe762249166481cce769 url
- http://ant.apache.org/security.html url
- http://commons.apache.org/compress/security.html url
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081746.html url
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105060.html url
…and 11 more