Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.
Users are recommended to upgrade to version 1.26.0 which fixes the issue.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade apache-commons-compressUpgrade apache-commons-compress-javadoc | Mar 19, 2024 | Feb 19, 2024 |
| Debian | — | No solution existsUpgrade libcommons-compress-java | May 15, 2025 | Feb 19, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.2Upgrade Splunk Enterprise to version 9.1.7Upgrade Splunk Enterprise to version 9.2.4 | Jul 30, 2026 | Feb 19, 2024 |
| Suse | — | Upgrade maven-doxia-module-xhtml5Upgrade maven-javadoc-plugin-bootstrapUpgrade maven-resources-pluginUpgrade apache-commons-compress-javadocUpgrade apache-commons-io-javadocUpgrade apache-commons-codec-javadocUpgrade maven-doxia-module-aptUpgrade maven-resources-plugin-bootstrapUpgrade maven-doxia-module-foUpgrade maven-jar-plugin-bootstrapUpgrade maven-doxia-module-rtfUpgrade maven-resolver-named-locksUpgrade apache-commons-ioUpgrade maven-resolver-utilUpgrade sbt-bootstrapUpgrade apache-commons-configuration2-javadocUpgrade maven-doxia-module-twikiUpgrade sbtUpgrade ivy-localUpgrade maven-doxia-sink-apiUpgrade maven-reporting-api-javadocUpgrade maven-resolver-transport-httpUpgrade maven-reporting-apiUpgrade maven-resolverUpgrade maven-resolver-spiUpgrade maven-javadocUpgrade xmvn-minimalUpgrade maven-resolver-apiUpgrade xmvn-parentUpgrade maven-javadoc-plugin-javadocUpgrade xmvn-apiUpgrade maven-jar-plugin-javadocUpgrade maven-doxia-module-xdocUpgrade gradle-localUpgrade maven-doxia-module-xhtmlUpgrade maven-doxia-sitetools-javadocUpgrade maven-assembly-pluginUpgrade maven-doxia-coreUpgrade maven-doxia-logging-apiUpgrade maven-doxia-sitetoolsUpgrade xmvn-resolveUpgrade xmvn-mojoUpgrade maven-resolver-test-utilUpgrade maven-javadoc-pluginUpgrade apache-commons-configuration2Upgrade maven-doxia-javadocUpgrade xmvn-installUpgrade maven-reporting-implUpgrade maven-doxia-module-docbook-simpleUpgrade maven-localUpgrade xmvn-mojo-javadocUpgrade maven-resources-plugin-javadocUpgrade maven-resolver-transport-wagonUpgrade maven-resolver-transport-classpathUpgrade maven-resolver-javadocUpgrade maven-doxia-module-latexUpgrade xmvn-substUpgrade maven-resolver-connector-basicUpgrade xmvnUpgrade apache-commons-codecUpgrade xmvn-coreUpgrade maven-doxia-module-confluenceUpgrade maven-doxia-module-fmlUpgrade maven-assembly-plugin-javadocUpgrade mavenUpgrade xmvn-connectorUpgrade maven-resolver-implUpgrade maven-resolver-transport-fileUpgrade maven-doxia-test-docsUpgrade apache-commons-compressUpgrade xmvn-connector-javadocUpgrade maven-jar-pluginUpgrade maven-reporting-impl-javadocUpgrade xmvn-tools-javadocUpgrade maven-lib | Mar 1, 2024 | Feb 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub