{"cve":"CVE-2019-12402","nvd":{"published":"2019-08-30T09:15:17.910","modified":"2026-06-17T02:14:34.853","status":"Modified","description":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-835"],"references":["https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r05cf37c1e1e662e968cfece1102fcd50fe207181fdbf2c30aadfafd3%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E"],"products":["apache:commons_compress","fedoraproject:fedora","oracle:banking_payments","oracle:banking_platform","oracle:communications_element_manager","oracle:communications_ip_service_activator","oracle:communications_session_report_manager","oracle:communications_session_route_manager","oracle:customer_management_and_segmentation_foundation","oracle:essbase","oracle:flexcube_investor_servicing","oracle:flexcube_private_banking","oracle:hyperion_infrastructure_technology","oracle:jdeveloper","oracle:peoplesoft_enterprise_pt_peopletools","oracle:primavera_gateway","oracle:retail_integration_bus","oracle:retail_xstore_point_of_service","oracle:webcenter_portal"],"source":"nvd","synced_at":"2026-10-19T20:58:39.700375520+00:00"},"epss":{"cve":"CVE-2019-12402","score":0.16157,"percentile":0.96932,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-53x6-4x5p-rrvv","url":"https://osv.dev/vulnerability/GHSA-53x6-4x5p-rrvv","summary":"Denial of Service in Apache Commons Compress","modified":"2024-03-16T05:19:51.255480Z","packages":[{"ecosystem":"Maven","name":"org.apache.commons:commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress","ranges":[">=1.15 <1.19"],"fixed":["1.19"]},{"ecosystem":"Maven","name":"io.github.1tchy.java9modular.org.apache.commons:commons-compress","purl":"pkg:maven/io.github.1tchy.java9modular.org.apache.commons/commons-compress","ranges":["1.18.1"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}