CVE-2021-36090: Uncontrolled Resource Consumption

July 13, 2021 (updated October 22, 2021)

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress’ zip package.

References

commons.apache.org/proper/commons-compress/security-reports.html
nvd.nist.gov/vuln/detail/CVE-2021-36090

Code Behaviors & Features

Detect and mitigate CVE-2021-36090 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →