Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-36090

31
FAUCET Score

CVE-2021-36090 describes a denial-of-service vulnerability in the Compress library's zip package, affecting products from Apache, NetApp, and Oracle. An unauthenticated attacker can exploit this by providing a specially crafted ZIP archive, causing the vulnerable system to allocate excessive memory and crash. Rated High (CVSS 7.5), this vulnerability is easily exploitable with low attack complexity and no user interaction required, leading to a complete loss of availability. Currently, there is no public exploit code available, nor is there evidence of active exploitation or significant community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
>= 1.0, < 1.21CPE matchmatch criteria
cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:*
>= 18.1, <= 18.3CPE matchmatch criteria
cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*
19.1CPE matchmatch criteria
cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*
19.2CPE matchmatch criteria
cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*
20.1CPE matchmatch criteria
cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
12.95%
Probability of exploitation in next 30 days
EPSS Percentile
95.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.1295 is in the 94th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

mavenpatch availablevia ghsa
Product: org.apache.commons:commons-compressFixed in: 1.21
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Fuse 7.11Fixed in: apache-commons-compress
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization Engine 4.4Fixed in: apache-commons-compress-0:1.21-1.2.el8ev
View patch
redhatend of lifevia redhat_api
Product: Red Hat Software CollectionsFixed in: rh-maven36-apache-commons-compress
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: apache-commons-compress
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: eclipse:rhel8/apache-commons-compress
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/apache-commons-compress

Vendor Advisories (2)

mavenGHSA-mc84-pj99-q6hhhigh

Improper Handling of Length Parameter Inconsistency in Compress

Aug 2, 2021
redhatCVE-2021-36090Moderate

apache-commons-compress: excessive memory allocation when reading a specially crafted ZIP archive

Jul 13, 2021

References

commons.apache.org / proper/commons-compress/security-reports.html
Vendor Advisory
lists.apache.org / thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9%40%3Cannounce.apache.org%3E
lists.apache.org / thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456%40%3Cdev.drill.apache.org%3E
lists.apache.org / thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd%40%3Cissues.drill.apache.org%3E
lists.apache.org / thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab%40%3Cdev.drill.apache.org%3E
lists.apache.org / thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949%40%3Ccommits.drill.apache.org%3E
lists.apache.org / thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E
lists.apache.org / thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5%40%3Cdev.tomcat.apache.org%3E
lists.apache.org / thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53%40%3Cannounce.apache.org%3E
lists.apache.org / thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E
lists.apache.org / thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E
lists.apache.org / thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E
lists.apache.org / thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E
lists.apache.org / thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7%40%3Cnotifications.james.apache.org%3E
lists.apache.org / thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E
lists.apache.org / thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E
lists.apache.org / thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E
lists.apache.org / thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d%40%3Cdev.drill.apache.org%3E
lists.apache.org / thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57%40%3Ccommits.druid.apache.org%3E
lists.apache.org / thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E
Vendor Advisory
lists.apache.org / thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf%40%3Cdev.drill.apache.org%3E
lists.apache.org / thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E
lists.apache.org / thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38%40%3Cuser.ant.apache.org%3E
lists.apache.org / thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88%40%3Ccommits.druid.apache.org%3E
lists.apache.org / thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6%40%3Cissues.drill.apache.org%3E
lists.apache.org / thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a%40%3Cissues.drill.apache.org%3E
lists.apache.org / thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E
security.netapp.com / advisory/ntap-20211022-0001
Third Party Advisory
oracle.com / security-alerts/cpuapr2022.html
PatchThird Party Advisory
oracle.com / security-alerts/cpujan2022.html
PatchThird Party Advisory
oracle.com / security-alerts/cpujul2022.html
PatchThird Party Advisory
oracle.com / security-alerts/cpuoct2021.html
Third Party Advisory
openwall.com / lists/oss-security/2021/07/13/4
Mailing ListThird Party Advisory
openwall.com / lists/oss-security/2021/07/13/6
Mailing ListThird Party Advisory