CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

Security readout for executives and security teams

Apache Commons Compress 1.0 through 1.20 can be forced to consume excessive memory when reading a specially crafted ZIP archive. Affected services may crash or become unavailable from small inputs. This is a denial-of-service risk, not evidence of data theft or code execution in the provided sources. Exposure is most likely in Java applications or Apache projects that use Commons Compress 1.0-1.20 to parse ZIP or ZIP-based archives, especially where users or external systems can submit archives for processing. Treat this as a practical availability issue. Prioritize internet-facing or business-critical systems that process ZIP uploads, then update remaining internal dependencies through normal patch management. Mitigation focus: Inventory direct and transitive Apache Commons Compress usage across Java applications.; Upgrade Commons Compress 1.0-1.20 to 1.21 or later where applicable.; Prioritize services that accept ZIP files from users, partners, or automated feeds..

Prepared

Jun 2, 2026, 19:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.