Denial of Service Vulnerability in Apache Commons Compress by Apache

CVE-2019-12402

What is CVE-2019-12402?

The vulnerability in Apache Commons Compress versions 1.15 to 1.18 involves a file name encoding algorithm that can enter an infinite loop when processing specially crafted input. This flaw can be exploited by an attacker to induce a denial of service (DoS) condition, especially if they can control the file names within an archive crafted using the Compress library. Organizations utilizing affected versions should consider upgrading to a patched version to mitigate this risk.

References