CVE-2021-35515

HIGH

Apache Commons Compress 1.6-1.19 - Denial of Service via Crafted 7Z Archive

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2021-35515. PoCs published by dawetmaster, andikahilmy.

AI-analyzed exploit summary This repository contains the source code of Apache Commons Compress at a vulnerable commit but lacks any exploit code or technical analysis. It appears to be a placeholder or reference for the vulnerable version.

Description

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Exploits (2)

nomisec STUB
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2021-35515-commons-compress-vulnerable

This repository contains the source code of Apache Commons Compress at a vulnerable commit but lacks any exploit code or technical analysis. It appears to be a placeholder or reference for the vulnerable version.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Apache Commons Compress
No auth needed
Prerequisites: Vulnerable version of Apache Commons Compress
devstral-2 · analyzed Mar 14, 2026 Full analysis →
nomisec WRITEUP
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2021-35515-commons-compress-vulnerable

This repository contains the source code of Apache Commons Compress in a vulnerable state (CVE-2021-35515), likely for analysis or testing purposes. It includes build configurations, documentation, and core Java source files but lacks explicit exploit code or technical analysis of the vulnerability itself.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Apache Commons Compress (version not explicitly specified)
No auth needed
Prerequisites: Access to a vulnerable version of Apache Commons Compress
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (21)

Core 21
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/07/13/1
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2022.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20211022-0001/
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujul2022.html

Scores

CVSS v3 7.5
EPSS 0.0119
EPSS Percentile 79.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-834 CWE-835
Status published
Products (46)
apache/commons_compress 1.6 - 1.20
netapp/active_iq_unified_manager (3 CPE variants)
netapp/oncommand_insight
oracle/banking_digital_experience 19.1
oracle/banking_digital_experience 20.1
oracle/banking_digital_experience 21.1
oracle/banking_digital_experience 18.1 - 18.3
oracle/banking_enterprise_default_management 2.7.0
oracle/banking_party_management 2.7.0
oracle/banking_payments 14.5
... and 36 more
Published Jul 13, 2021
Tracked Since Feb 18, 2026