CVE-2021-36374

5.5 mediumEPSS 2.6%

Medium (5.5). EPSS 2.6% chance of exploitation in the next 30 days. Fixed in org.apache.ant:ant 1.10.11, 1.9.16.

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-130
Published: 2021-07-14
Modified: 2026-08-25
Record from: the NVD, synced 2026-10-19

Affected

apache:ant
oracle:agile_engineering_data_management
oracle:agile_product_lifecycle_management
oracle:banking_trade_finance
oracle:banking_treasury_management
oracle:communications_cloud_native_core_automated_test_suite
oracle:communications_cloud_native_core_binding_support_function
oracle:communications_diameter_intelligence_hub
oracle:communications_order_and_service_management
oracle:communications_unified_inventory_management
oracle:enterprise_repository
oracle:financial_services_analytical_applications_infrastructure
oracle:health_sciences_information_manager
oracle:insurance_policy_administration
oracle:primavera_gateway
oracle:primavera_unifier
oracle:product_lifecycle_analytics
oracle:real-time_decision_server
oracle:retail_advanced_inventory_planning
oracle:retail_back_office
oracle:retail_bulk_data_integration
oracle:retail_central_office
oracle:retail_eftlink
oracle:retail_extract_transform_and_load
oracle:retail_financial_integration
oracle:retail_integration_bus
oracle:retail_invoice_matching
oracle:retail_merchandising_system
oracle:retail_point-of-service
oracle:retail_predictive_application_server
oracle:retail_service_backbone
oracle:retail_store_inventory_management
oracle:retail_xstore_point_of_service
oracle:timesten_in-memory_database
oracle:utilities_framework
oracle:utilities_testing_accelerator

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-5v34-g2px-j4fw	Maven	org.apache.ant:ant	>=1.9.0 <1.9.16	1.9.16
GHSA-5v34-g2px-j4fw	Maven	org.apache.ant:ant	>=1.10.0 <1.10.11	1.10.11

References

Check your stack JSON