CVE-2024-25710: Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress: from 1.3 through 1.25.0.
Users are recommended to upgrade to version 1.26.0 which fixes the issue.
Other sources
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.
Users are recommended to upgrade to version 1.26.0 which fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.commons:commons-compressto a version that resolves this vulnerability.Fixed in 1.26.0 - Upgrade
Upgrade
redhat/Apache Commons Compressto a version that resolves this vulnerability.Fixed in 1.26 - Upgrade
Upgrade
Apache Commons Compressto a version that resolves this vulnerability.Fixed in 1.26.0Patch CVE-2024-25710
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25710?
CVE-2024-25710 has a severity level classified as a denial of service vulnerability.
How do I fix CVE-2024-25710?
To fix CVE-2024-25710, upgrade Apache Commons Compress to version 1.26.0 or later.
Which versions are affected by CVE-2024-25710?
CVE-2024-25710 affects Apache Commons Compress versions from 1.3 up to 1.26.0.
Can CVE-2024-25710 be exploited remotely?
Yes, CVE-2024-25710 can be exploited remotely by persuading a victim to open a specially crafted DUMP file.
What causes the vulnerability in CVE-2024-25710?
CVE-2024-25710 is caused by an infinite loop flaw that leads to a denial of service condition.