Vulnerability record · CVE-2012-2098 · published 29 June 2012

CVE-2012-2098: Apache commons compress vulnerability

Apache · Commons Compress

Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.

5.0 CVSS 2.0 Medium EPSS 13% · top 3.8% CWE-310 · CWE-310

5.0CVSS 2.0 base score

13%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

36References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Commons Compress Apache

References

Link	Tags
http://ant.apache.org/security.html	Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2012-05/0130.html	Third Party Advisory
http://commons.apache.org/compress/security.html	Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081697.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081746.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105049.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105060.html	Third Party Advisory
http://osvdb.org/82161	Broken Link
http://packetstormsecurity.org/files/113014/Apache-Commons-Compress-Apache-Ant-Denial-Of-Service.html	Third Party Advisory
http://secunia.com/advisories/49255	Vendor Advisory
http://secunia.com/advisories/49286	Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21644047	Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/13/3
http://www.securityfocus.com/bid/53676	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1027096	Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/75857	Third Party AdvisoryVDB Entry
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apa
https://www.oracle.com/security-alerts/cpujan2021.html	Third Party Advisory
http://ant.apache.org/security.html	Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2012-05/0130.html	Third Party Advisory
http://commons.apache.org/compress/security.html	Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081697.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081746.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105049.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105060.html	Third Party Advisory
http://osvdb.org/82161	Broken Link
http://packetstormsecurity.org/files/113014/Apache-Commons-Compress-Apache-Ant-Denial-Of-Service.html	Third Party Advisory
http://secunia.com/advisories/49255	Vendor Advisory
http://secunia.com/advisories/49286	Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21644047	Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/13/3
http://www.securityfocus.com/bid/53676	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1027096	Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/75857	Third Party AdvisoryVDB Entry
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apa
https://www.oracle.com/security-alerts/cpujan2021.html	Third Party Advisory

Track CVE-2012-2098 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2021-35515Apache commons compress vulnerabilityWhen reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This cou…EPSS 12%13 Jul 2021 7.5CVE-2021-35516Apache commons compress allocation without limits vulnerabilityWhen reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error ev…EPSS 12%13 Jul 2021 7.5CVE-2021-35517Apache commons compress allocation without limits vulnerabilityWhen reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error e…EPSS 11%13 Jul 2021 7.5CVE-2021-36090Apache commons compress vulnerabilityWhen reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error e…EPSS 13%13 Jul 2021 7.5CVE-2019-12402Apache commons compress vulnerabilityThe file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially craf…EPSS 16%30 Aug 2019 5.5CVE-2024-26308Apache commons compress allocation without limits vulnerabilityAllocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 b…EPSS 0.90%19 Feb 2024 5.5CVE-2024-25710Apache commons compress vulnerabilityLoop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 …EPSS 0.44%19 Feb 2024 5.5CVE-2023-42503Apache commons compress improper input validation vulnerabilityImproper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Common…EPSS 0.60%14 Sep 2023

Source: NIST National Vulnerability Database (record CVE-2012-2098), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.