{"cve":"CVE-2021-35515","nvd":{"published":"2021-07-13T08:15:07.033","modified":"2026-06-17T03:57:36.793","status":"Modified","description":"When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-835","CWE-834"],"references":["http://www.openwall.com/lists/oss-security/2021/07/13/1","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E"],"products":["apache:commons_compress","netapp:active_iq_unified_manager","netapp:oncommand_insight","oracle:banking_digital_experience","oracle:banking_enterprise_default_management","oracle:banking_party_management","oracle:banking_payments","oracle:banking_trade_finance","oracle:banking_treasury_management","oracle:business_process_management_suite","oracle:commerce_guided_search","oracle:communications_billing_and_revenue_management","oracle:communications_cloud_native_core_automated_test_suite","oracle:communications_cloud_native_core_service_communication_proxy","oracle:communications_cloud_native_core_unified_data_repository","oracle:communications_diameter_intelligence_hub","oracle:communications_messaging_server","oracle:communications_session_route_manager","oracle:financial_services_crime_and_compliance_management_studio","oracle:financial_services_enterprise_case_management","oracle:flexcube_universal_banking","oracle:healthcare_data_repository","oracle:insurance_policy_administration","oracle:peoplesoft_enterprise_peopletools","oracle:primavera_unifier","oracle:utilities_testing_accelerator"],"source":"nvd","synced_at":"2026-10-19T21:21:13.713336758+00:00"},"epss":{"cve":"CVE-2021-35515","score":0.11567,"percentile":0.96034,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-7hfm-57qf-j43q","url":"https://osv.dev/vulnerability/GHSA-7hfm-57qf-j43q","summary":"Excessive Iteration in Compress","modified":"2024-03-08T05:18:24.619639Z","packages":[{"ecosystem":"Maven","name":"org.apache.commons:commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress","ranges":["<1.21"],"fixed":["1.21"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}