CVE-2019-12402

HIGH

Apache Commons Compress <1.19 - DoS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2019-12402. PoCs published by dawetmaster, andikahilmy.

AI-analyzed exploit summary This repository contains the source code for Apache Commons Compress, specifically a vulnerable version (b95d5cd) related to CVE-2019-12402. However, it lacks any exploit code, proof-of-concept, or technical analysis of the vulnerability itself.

Description

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

Exploits (2)

nomisec STUB
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2019-12402-commons-compress-vulnerable

This repository contains the source code for Apache Commons Compress, specifically a vulnerable version (b95d5cd) related to CVE-2019-12402. However, it lacks any exploit code, proof-of-concept, or technical analysis of the vulnerability itself.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Apache Commons Compress
No auth needed
Prerequisites: Vulnerable version of Apache Commons Compress
devstral-2 · analyzed Mar 14, 2026 Full analysis →
nomisec WRITEUP
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2019-12402-commons-compress-vulnerable

This repository contains the vulnerable source code of Apache Commons Compress, which is affected by CVE-2019-12402. The vulnerability is related to infinite loop and denial-of-service (DoS) conditions in the ARJ archive handling. The repository includes build instructions and contributing guidelines but does not contain an exploit PoC or scanner.

Classification
Writeup 90%
Attack Type
Dos
Complexity
Moderate
Reliability
Theoretical
Target: Apache Commons Compress (versions prior to 1.19)
No auth needed
Prerequisites: Malicious ARJ archive file · Application using vulnerable Apache Commons Compress library
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (30)

Core 30
Core References
Not Applicable, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Scores

CVSS v3 7.5
EPSS 0.0041
EPSS Percentile 62.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-835
Status published
Products (40)
apache/commons_compress 1.15 - 1.18
fedoraproject/fedora 30
fedoraproject/fedora 31
io.github.1tchy.java9modular.org.apache.commons/commons-compress Maven
oracle/banking_payments 14.1.0 - 14.4.0
oracle/banking_platform 2.6.2
oracle/banking_platform 2.7.0
oracle/banking_platform 2.8.0
oracle/banking_platform 2.9.0
oracle/communications_element_manager 8.2.0 - 8.2.2
... and 30 more
Published Aug 30, 2019
Tracked Since Feb 18, 2026