CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

Security readout for executives and security teams

A small malicious TAR archive can make vulnerable Apache Commons Compress versions consume excessive memory until the Java process runs out of memory. The likely business impact is service disruption where applications accept or process TAR files from users, partners, or automated feeds. Exposure is most likely in Java applications that use Apache Commons Compress to parse TAR files, especially upload, extraction, scanning, backup, build, or ingestion workflows. Transitive dependencies should be checked because downstream Apache project threads reference upgrades to commons-compress 1.21. Treat this as a targeted availability risk, not a data theft issue based on current sources. Prioritize internet-facing or business-critical services that process uploaded TAR archives, then address internal tooling and transitive dependencies. Mitigation focus: Upgrade Apache Commons Compress beyond affected 1.1 through 1.20, following Apache guidance.; Check dependency trees for transitive commons-compress versions.; Restrict untrusted TAR processing where upgrades are delayed..

Prepared

Jun 2, 2026, 19:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.