Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.
Users are recommended to upgrade to version 1.26.0 which fixes the issue.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade apache-commons-compressUpgrade apache-commons-compress-javadoc | Mar 19, 2024 | Feb 19, 2024 |
| Debian | — | Upgrade libcommons-compress-java | May 15, 2025 | Feb 19, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.4Upgrade Splunk Enterprise to version 9.1.7Upgrade Splunk Enterprise to version 9.3.2 | Jul 30, 2026 | Feb 19, 2024 |
| Suse | — | Upgrade maven-doxia-module-confluenceUpgrade apache-commons-configuration2Upgrade maven-localUpgrade maven-reporting-impl-javadocUpgrade maven-jar-pluginUpgrade maven-resolver-javadocUpgrade maven-resolver-transport-wagonUpgrade maven-javadoc-pluginUpgrade maven-doxia-module-latexUpgrade xmvnUpgrade xmvn-substUpgrade maven-resolver-test-utilUpgrade maven-libUpgrade xmvn-connector-javadocUpgrade maven-assembly-plugin-javadocUpgrade maven-doxia-javadocUpgrade maven-resolver-transport-fileUpgrade xmvn-connectorUpgrade mavenUpgrade maven-reporting-implUpgrade xmvn-mojoUpgrade xmvn-resolveUpgrade maven-doxia-module-fmlUpgrade maven-doxia-test-docsUpgrade apache-commons-compressUpgrade maven-doxia-module-docbook-simpleUpgrade maven-resolver-implUpgrade xmvn-installUpgrade maven-resolver-connector-basicUpgrade maven-resolver-transport-classpathUpgrade maven-resources-plugin-javadocUpgrade xmvn-coreUpgrade xmvn-tools-javadocUpgrade xmvn-mojo-javadocUpgrade apache-commons-codecUpgrade maven-assembly-pluginUpgrade maven-doxia-sitetools-javadocUpgrade sbtUpgrade maven-doxia-coreUpgrade xmvn-minimalUpgrade maven-javadocUpgrade maven-jar-plugin-bootstrapUpgrade maven-doxia-module-twikiUpgrade maven-doxia-logging-apiUpgrade maven-javadoc-plugin-javadocUpgrade maven-doxia-module-xdocUpgrade xmvn-apiUpgrade maven-doxia-sitetoolsUpgrade maven-doxia-module-xhtmlUpgrade ivy-localUpgrade maven-resolverUpgrade maven-resolver-spiUpgrade maven-reporting-apiUpgrade maven-doxia-module-rtfUpgrade apache-commons-configuration2-javadocUpgrade sbt-bootstrapUpgrade maven-resolver-utilUpgrade maven-resolver-apiUpgrade maven-resolver-named-locksUpgrade xmvn-parentUpgrade apache-commons-ioUpgrade gradle-localUpgrade maven-jar-plugin-javadocUpgrade apache-commons-compress-javadocUpgrade apache-commons-codec-javadocUpgrade maven-resources-plugin-bootstrapUpgrade maven-resources-pluginUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-doxia-module-xhtml5Upgrade maven-doxia-module-foUpgrade maven-doxia-module-aptUpgrade apache-commons-io-javadocUpgrade maven-resolver-transport-httpUpgrade maven-reporting-api-javadocUpgrade maven-doxia-sink-api | Mar 1, 2024 | Feb 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub