Skip to content
Fencer Vulns
high 7.5

CVE-2019-12402 in the critical feed json

Denial of Service in Apache Commons Compress

published 2019-08-29 7 y ago modified 2026-06-17 4 mo ago also GHSA-53x6-4x5p-rrvv , EUVD-2019-0685

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
16.2%
EPSS 16.2% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

Patch / fix

  • maven org.apache.commons:commons-compress 1.19
  • libcommons-compress-java Debian 14, Debian 13, Debian 12 1.18-3

debian advisories DEBIAN-CVE-2019-12402

  • apache-commons-compress openSUSE Tumbleweed 1.21-1.2

opensuse advisories openSUSE-SU-2024:10618-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-12402 updated cvss 7.5

apache-commons-compress: Infinite loop in name encoding algorithm

  • Red Hat JBoss Data Virtualization 6 apache-commons-compress
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7.9
    fixed: vendor fix RHSA-2021:3140
  • Red Hat A-MQ Clients 2 apache-commons-compress Red Hat BPM Suite 6 apache-commons-compress Red Hat Data Grid 8 apache-commons-compress Red Hat Decision Manager 7 apache-commons-compress Red Hat Enterprise Linux 7 apache-commons-compress, apache-commons-compress-javadoc Red Hat Integration Camel K 1 apache-commons-compress
    +8 more products
    Red Hat Integration Service Registry apache-commons-compress Red Hat JBoss BRMS 6 apache-commons-compress Red Hat JBoss Enterprise Application Platform 6 apache-commons-compress Red Hat JBoss Fuse 6 apache-commons-compress Red Hat JBoss Fuse Service Works 6 apache-commons-compress Red Hat Process Automation 7 apache-commons-compress Red Hat Software Collections rh-maven35-apache-commons-compress, rh-maven36-apache-commons-compress, rh-java-common-apache-commons-compress, rh-maven35-apache-commons-compress-javadoc, rh-maven36-apache-commons-compress-javadoc, rh-java-common-apache-commons-compress-javadoc Red Hat Virtualization 4 apache-commons-compress, apache-commons-compress-javadoc
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

16.16% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.commons:commons-compress
>=1.15, <1.19
1.19
maven io.github.1tchy.java9modular.org.apache.commons:commons-compress
1 listed version
 no fix listed

Affected products

  • Apache Software Foundation Apache Commons Compress

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.