Skip to content
Fencer Vulns
medium 5.5

CVE-2023-42503 json

Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file

published 2023-09-14 3 y ago modified 2026-09-10 1 mo ago also GHSA-cgwf-w82q-5jrr , EUVD-2023-2489

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0.

Users are recommended to upgrade to version 1.24.0, which fixes the issue.

A third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption.

In version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example “1647221103.5998539”). The impacted fields are “atime”, “ctime”, “mtime” and “LIBARCHIVE.creationtime”. No input validation is performed prior to the parsing of header values.

Parsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as “9e9999999”) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5].

[1]: https://issues.apache.org/jira/browse/COMPRESS-612 [2]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 [3]: https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html [4]: https://bugs.openjdk.org/browse/JDK-6560193 [5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098

Only applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.

Patch / fix

  • maven org.apache.commons:commons-compress 1.24.0
  • Apache Software Foundation Apache Commons Compress 1.24.0
  • libcommons-compress-java Debian 14, Debian 13 1.24.0-1

debian advisories DEBIAN-CVE-2023-42503

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-42503 updated cvss 5.5

apache-commons-compress: Denial of service via CPU consumption for malformed TAR file

  • Red Hat Integration Camel K 1 commons-compress
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Process Automation 7 commons-compress Red Hat Single Sign-On 7 commons-compress
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat build of Apache Camel 4 for Quarkus 3 commons-compress Red Hat build of Apicurio Registry 2 commons-compress Red Hat Build of Keycloak commons-compress Red Hat build of OptaPlanner 8 commons-compress Red Hat build of Quarkus commons-compress Red Hat Data Grid 8 commons-compress
    +1 more products
    Red Hat Fuse 7 commons-compress
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.commons:commons-compress
>=1.22, <1.24.0
1.24.0

Affected products

  • Apache Software Foundation Apache Commons Compress

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.