CVE-2021-35515

7.5 highEPSS 12%

High (7.5). EPSS 12% chance of exploitation in the next 30 days. Fixed in org.apache.commons:commons-compress 1.21.

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 12% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWEs: CWE-835, CWE-834
Published: 2021-07-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:commons_compress
netapp:active_iq_unified_manager
netapp:oncommand_insight
oracle:banking_digital_experience
oracle:banking_enterprise_default_management
oracle:banking_party_management
oracle:banking_payments
oracle:banking_trade_finance
oracle:banking_treasury_management
oracle:business_process_management_suite
oracle:commerce_guided_search
oracle:communications_billing_and_revenue_management
oracle:communications_cloud_native_core_automated_test_suite
oracle:communications_cloud_native_core_service_communication_proxy
oracle:communications_cloud_native_core_unified_data_repository
oracle:communications_diameter_intelligence_hub
oracle:communications_messaging_server
oracle:communications_session_route_manager
oracle:financial_services_crime_and_compliance_management_studio
oracle:financial_services_enterprise_case_management
oracle:flexcube_universal_banking
oracle:healthcare_data_repository
oracle:insurance_policy_administration
oracle:peoplesoft_enterprise_peopletools
oracle:primavera_unifier
oracle:utilities_testing_accelerator

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-7hfm-57qf-j43q	Maven	org.apache.commons:commons-compress	<1.21	1.21

References

Check your stack JSON