CVE-2021-36090Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

7.5HighCVSS base score
12.9%Exploitation in 30 daysEPSS · top 3.6% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Timeline

2021
1 Jul 2021
1 Jul 2021
ID reserved
By apache
13 Jul 202112 days later
13 Jul 2021· 12 days later
Published
2026
8 Oct 20265 years later
8 Oct 2026· 5 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2021-36090, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 12.9% · top 3.6% of all CVEs (14 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

Apache Software Foundation · Apache Commons Compress
- affected Apache Commons Compress – ≤ 1.20

Affected packages

From reviewed advisories of the GitHub Advisory Database.

Mavenorg.apache.commons:commons-compressGHSA-mc84-pj99-q6hh (opens in a new tab)

What to do

Workaround: Commons Compress users should upgrade to 1.21 or later.

References34

https://commons.apache.org/proper/commons-compress/security-reports.html (opens in a new tab)x_refsource_MISCx_transferred
https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
[oss-security] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[announce] 20210713 CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[ant-user] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[announce] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[oss-security] 20210713 CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[james-notifications] 20210714 [GitHub] [james-project] chibenwa opened a new pull request #537: [UPGRADE] Security upgrade: common-compress to 1.21 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[pulsar-commits] 20210716 [GitHub] [pulsar] lhotari opened a new pull request #11345: [Security] Upgrade commons-compress to 1.21 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[druid-commits] 20210726 [GitHub] [druid] suneet-s opened a new pull request #11496: Address CVE-2021-35515 CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[druid-commits] 20210726 [GitHub] [druid] suneet-s merged pull request #11496: Address CVE-2021-35515 CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[druid-commits] 20210726 [druid] branch master updated: Address CVE-2021-35515 CVE-2021-36090 (#11496) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[skywalking-notifications] 20210802 [GitHub] [skywalking] wu-sheng opened a new pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[skywalking-notifications] 20210802 [skywalking] 01/01: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[skywalking-notifications] 20210803 [skywalking] branch master updated: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (#7400) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[skywalking-notifications] 20210803 [GitHub] [skywalking] hanahmily merged pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[skywalking-notifications] 20210803 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] commented on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[skywalking-notifications] 20210802 [GitHub] [skywalking] codecov[bot] edited a comment on pull request #7400: Fix CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[drill-dev] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[drill-issues] 20210803 [jira] [Created] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[drill-dev] 20210804 [GitHub] [drill] luocooong opened a new pull request #2285: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[drill-commits] 20210804 [drill] branch master updated: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[drill-dev] 20210804 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[drill-issues] 20210804 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[drill-dev] 20210805 [GitHub] [drill] luocooong merged pull request #2285: DRILL-7981: Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[drill-issues] 20210805 [jira] [Commented] (DRILL-7981) Bump commons-compress from 1.20 to 1.21 for CVE-2021-36090 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[tomcat-dev] 20210811 [GitHub] [tomcat-jakartaee-migration] ebourg commented on issue #23: Vulnerability with Apache Commons Compress v1.20 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[poi-dev] 20210923 Re: [VOTE] Apache POI 5.1.0 release (RC1) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
https://www.oracle.com/security-alerts/cpuoct2021.html (opens in a new tab)x_refsource_MISCx_transferred
https://www.oracle.com/security-alerts/cpujan2022.html (opens in a new tab)x_refsource_MISCx_transferred
https://security.netapp.com/advisory/ntap-20211022-0001/ (opens in a new tab)x_refsource_CONFIRMx_transferred
https://www.oracle.com/security-alerts/cpuapr2022.html (opens in a new tab)x_refsource_MISCx_transferred
https://www.oracle.com/security-alerts/cpujul2022.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2021-36090](https://cveledger.app/badge/CVE-2021-36090.svg)](https://cveledger.app/cve/CVE-2021-36090)

Record last updated 8 Oct 2026, 21:03 UTC.