Security readout for executives and security teams
Plain-English summary
Apache Ant could run out of memory when a build reads a specially crafted TAR archive. The practical business impact is interrupted or failed builds, especially in CI or release pipelines that process archive inputs.
Executive priority
Treat this as a build-pipeline resilience issue rather than a confirmed active breach risk. Prioritize upgrades where Ant processes external or partner-supplied archives.
Technical view
CVE-2021-36373 is a TAR parsing denial-of-service issue in Apache Ant. A crafted TAR can cause excessive memory allocation, producing an out-of-memory error even from small inputs. Apache Ant before 1.9.16 and before 1.10.11 is affected.
Likely exposure
Exposure is most likely in build, CI, packaging, or developer workflows using Apache Ant directly or through bundled dependencies. The source bundle does not show ordinary public web exposure by default.
Exploitation context
The bundle describes disruption when an affected Ant build reads a crafted TAR archive. It does not cite KEV listing, public active exploitation, or remote unauthenticated exploitation in production services.
Researcher notes
The CVE source identifies CWE-130 and affected Ant 1.9.x and 1.10.x before fixed releases. No CVSS vector is provided in the bundle, and exploit evidence is limited to the stated crafted-archive denial-of-service condition.
Mitigation direction
- Upgrade Apache Ant to 1.9.16, 1.10.11, or later supported releases.
- Inventory direct and transitive Ant usage in build tools and CI images.
- Check downstream vendor advisories for products bundling Apache Ant.
- Restrict untrusted TAR archives from automated Ant build workflows.
- Apply memory and job-failure controls around archive-processing build stages.
Validation and detection
- Confirm installed Apache Ant versions across developer machines, CI runners, and build containers.
- Review dependency trees for bundled Ant versions below 1.9.16 or 1.10.11.
- Verify build workflows do not process untrusted TAR files with vulnerable Ant.
- Confirm vendor-supplied products have incorporated the Ant security update.
- Track CI failures for unexplained out-of-memory events during TAR handling.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-130: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-36373 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://ant.apache.org/security.htmlCVE reference · x_refsource_MISC
- https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3ECVE reference · x_refsource_MISC
- [groovy-commits] 20210714 [groovy] 08/09: GROOVY-10169: Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)CVE reference · mailing-list, x_refsource_MLIST
- [groovy-commits] 20210715 [groovy] 02/07: GROOVY-10169: Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)CVE reference · mailing-list, x_refsource_MLIST
- [groovy-notifications] 20210715 [jira] [Resolved] (GROOVY-10169) Bump Ant version to 1.10.11 (incorporates CVE-2021-36373 and CVE-2021-36374)CVE reference · mailing-list, x_refsource_MLIST
- [myfaces-dev] 20210830 [GitHub] [myfaces-tobago] lofwyr14 opened a new pull request #1215: build: CVE fixCVE reference · mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuoct2021.htmlCVE reference · x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210819-0007/CVE reference · x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpujan2022.htmlCVE reference · x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.htmlCVE reference · x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Handling of Length Parameter Inconsistency
Improper Handling of Length Parameter Inconsistency represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.