When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache-ant | Aug 22, 2024 | Jul 14, 2021 |
| Amazon Linux Ami 2 | — | Upgrade ant-antlrUpgrade ant-jschUpgrade ant-jmfUpgrade ant-apache-xalan2Upgrade ant-swingUpgrade ant-junitUpgrade ant-apache-log4jUpgrade ant-commons-netUpgrade ant-manualUpgrade ant-javadocUpgrade ant-commons-loggingUpgrade ant-apache-resolverUpgrade ant-apache-oroUpgrade ant-javamailUpgrade ant-testutilUpgrade ant-apache-bsfUpgrade ant-apache-regexpUpgrade ant-jdependUpgrade antUpgrade ant-apache-bcel | Dec 7, 2022 | Jul 14, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 14, 2021 |
| Debian | — | Upgrade ant | Jul 30, 2024 | Jul 14, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ant | May 25, 2022 | Jul 14, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ant | Nov 12, 2021 | Jul 14, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade antUpgrade ant-lib | Sep 24, 2021 | Jul 14, 2021 |
| Oracle Solaris | — | Upgrade developer/build/ant to version 1.10.11-11.4.39.0.1.107.0 on Solaris 11.4 | Nov 17, 2021 | Jul 14, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 35893811 for version 12.2.1.4.0. | Oct 19, 2023 | Jul 14, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 14, 2021 |
| Suse | — | Upgrade ant-commons-loggingUpgrade ant-scriptsUpgrade ant-apache-xalan2Upgrade ant-jschUpgrade ant-javadocUpgrade ant-jmfUpgrade ant-junitUpgrade ant-manualUpgrade ant-imageioUpgrade ant-antlrUpgrade ant-commons-netUpgrade ant-swingUpgrade ant-xzUpgrade ant-apache-oroUpgrade ant-apache-regexpUpgrade ant-javamailUpgrade ant-testutilUpgrade ant-apache-resolverUpgrade ant-apache-log4jUpgrade ant-jdependUpgrade ant-junit5Upgrade ant-apache-bsfUpgrade ant-apache-bcelUpgrade ant | Oct 26, 2022 | Jul 14, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2021 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub