When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-apache-ant | Aug 22, 2024 | Jul 14, 2021 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-antamazon-linux-ami-2-upgrade-ant-antlramazon-linux-ami-2-upgrade-ant-apache-bcelamazon-linux-ami-2-upgrade-ant-apache-bsfamazon-linux-ami-2-upgrade-ant-apache-log4jamazon-linux-ami-2-upgrade-ant-apache-oroamazon-linux-ami-2-upgrade-ant-apache-regexpamazon-linux-ami-2-upgrade-ant-apache-resolveramazon-linux-ami-2-upgrade-ant-apache-xalan2amazon-linux-ami-2-upgrade-ant-commons-loggingamazon-linux-ami-2-upgrade-ant-commons-netamazon-linux-ami-2-upgrade-ant-javadocamazon-linux-ami-2-upgrade-ant-javamailamazon-linux-ami-2-upgrade-ant-jdependamazon-linux-ami-2-upgrade-ant-jmfamazon-linux-ami-2-upgrade-ant-jschamazon-linux-ami-2-upgrade-ant-junitamazon-linux-ami-2-upgrade-ant-manualamazon-linux-ami-2-upgrade-ant-swingamazon-linux-ami-2-upgrade-ant-testutil | Dec 7, 2022 | Jul 14, 2021 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jul 14, 2021 | |
| Debian | debian-upgrade-ant | Jul 30, 2024 | Jul 14, 2021 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-ant | May 25, 2022 | Jul 14, 2021 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-ant | Nov 12, 2021 | Jul 14, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-anthuawei-euleros-2_0_sp8-upgrade-ant-lib | Sep 24, 2021 | Jul 14, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-developer-build-ant-1-10-11-11-4-39-0-1-107-0 | Nov 17, 2021 | Jul 14, 2021 | |
| Oracle Weblogic | oracle-weblogic-oct-2023-cpu-12_2_1_4_0oracle-weblogic-oct-2023-cpu-14_1_1_0_0 | Oct 19, 2023 | Jul 14, 2021 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Jul 14, 2021 | |
| Suse | — | suse-upgrade-antsuse-upgrade-ant-antlrsuse-upgrade-ant-apache-bcelsuse-upgrade-ant-apache-bsfsuse-upgrade-ant-apache-log4jsuse-upgrade-ant-apache-orosuse-upgrade-ant-apache-regexpsuse-upgrade-ant-apache-resolversuse-upgrade-ant-apache-xalan2suse-upgrade-ant-commons-loggingsuse-upgrade-ant-commons-netsuse-upgrade-ant-imageiosuse-upgrade-ant-javadocsuse-upgrade-ant-javamailsuse-upgrade-ant-jdependsuse-upgrade-ant-jmfsuse-upgrade-ant-jschsuse-upgrade-ant-junitsuse-upgrade-ant-junit5suse-upgrade-ant-manualsuse-upgrade-ant-scriptssuse-upgrade-ant-swingsuse-upgrade-ant-testutilsuse-upgrade-ant-xz | Oct 26, 2022 | Jul 14, 2021 |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jul 14, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub