Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.
Users are recommended to upgrade to version 1.26.0 which fixes the issue.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade apache-commons-compress-javadocUpgrade apache-commons-compress | Mar 19, 2024 | Feb 19, 2024 |
| Debian | — | Upgrade libcommons-compress-java | May 15, 2025 | Feb 19, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.2Upgrade Splunk Enterprise to version 9.1.7Upgrade Splunk Enterprise to version 9.2.4 | Jul 30, 2026 | Feb 19, 2024 |
| Suse | — | Upgrade maven-reporting-apiUpgrade maven-resolverUpgrade sbt-bootstrapUpgrade apache-commons-compress-javadocUpgrade maven-resolver-named-locksUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-resolver-apiUpgrade apache-commons-codec-javadocUpgrade maven-resolver-spiUpgrade maven-reporting-api-javadocUpgrade maven-doxia-module-xhtml5Upgrade maven-resources-pluginUpgrade maven-doxia-module-foUpgrade apache-commons-io-javadocUpgrade maven-doxia-module-aptUpgrade maven-resources-plugin-bootstrapUpgrade maven-resolver-transport-httpUpgrade maven-doxia-sink-apiUpgrade apache-commons-ioUpgrade maven-doxia-module-xhtmlUpgrade maven-javadoc-plugin-javadocUpgrade ivy-localUpgrade maven-doxia-sitetools-javadocUpgrade maven-jar-plugin-javadocUpgrade gradle-localUpgrade sbtUpgrade maven-doxia-module-xdocUpgrade xmvn-apiUpgrade xmvn-parentUpgrade maven-doxia-sitetoolsUpgrade maven-jar-plugin-bootstrapUpgrade maven-doxia-logging-apiUpgrade maven-javadocUpgrade maven-doxia-module-rtfUpgrade maven-resolver-utilUpgrade apache-commons-configuration2-javadocUpgrade maven-assembly-pluginUpgrade xmvn-minimalUpgrade maven-doxia-coreUpgrade maven-doxia-module-twikiUpgrade maven-resolver-javadocUpgrade maven-jar-pluginUpgrade apache-commons-compressUpgrade maven-assembly-plugin-javadocUpgrade apache-commons-configuration2Upgrade xmvn-connector-javadocUpgrade xmvnUpgrade maven-doxia-module-latexUpgrade xmvn-tools-javadocUpgrade xmvn-installUpgrade apache-commons-codecUpgrade maven-doxia-module-fmlUpgrade maven-doxia-module-docbook-simpleUpgrade maven-resolver-implUpgrade mavenUpgrade maven-javadoc-pluginUpgrade maven-resolver-connector-basicUpgrade maven-resolver-transport-classpathUpgrade maven-resolver-test-utilUpgrade xmvn-mojoUpgrade maven-resolver-transport-wagonUpgrade maven-resolver-transport-fileUpgrade maven-doxia-test-docsUpgrade xmvn-connectorUpgrade maven-reporting-impl-javadocUpgrade maven-resources-plugin-javadocUpgrade xmvn-substUpgrade xmvn-resolveUpgrade xmvn-mojo-javadocUpgrade xmvn-coreUpgrade maven-localUpgrade maven-doxia-module-confluenceUpgrade maven-reporting-implUpgrade maven-libUpgrade maven-doxia-javadoc | Mar 1, 2024 | Feb 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub