CVE-2012-2098: Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2Compressor...

Security readout for executives and security teams

This flaw lets crafted repetitive input make affected Apache Commons Compress bzip2 compression consume excessive CPU. The business impact is service slowdown or outage when an application compresses attacker-controlled data. The bundle provides no CVSS score and does not show known active exploitation. Most likely exposed systems are Java applications, build tooling, or downstream products that bundle Apache Commons Compress before 1.4.1 and compress user-supplied or remote-supplied data with bzip2. Prioritize remediation where affected Java services process user-controlled files or data. This is primarily an availability risk, not a data theft issue based on the provided sources. Patch during normal vulnerability maintenance unless exposed compression endpoints support critical services. Mitigation focus: Upgrade Apache Commons Compress to version 1.4.1 or later.; Check Apache Ant guidance if Ant bundles or exposes the affected code path.; Review OS vendor advisories for packaged dependency updates..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.