title: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
description: When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
problem types: CWE-834 Excessive Iteration
affected:
{
product: Apache Commons Compress
vendor: Apache Software Foundation
versions:
lessThan: Apache Commons Compress*, status: affected, version: 1.6, versionType: custom
}
metrics:
other: [
content: {'other': 'low'}
type: unknown
]
workarounds: Commons Compress users should upgrade to 1.21 or later.