Update Apache Commons Compress Now to Fix Critical Infinite Loop Vulnerability

CVSScvssV3_1: 8.1

Apache Commons Compress is an open-source library used for compressing and decompressing files. It was found to contain a vulnerability that could allow attackers to launch denial-of-service (DoS) attacks by exploiting an infinite loop condition.

The vulnerability, tracked as CVE-2024-25710, is due to an issue in Commons Compress versions 1.3 through 1.25.0 where an unreachable exit condition is present in a loop. This causes the program to get stuck in an infinite loop, consuming resources. An attacker could craft a specially crafted compressed file to trigger this loop when the file is decompressed.

If exploited, this vulnerability would allow remote attackers to cause the application using Commons Compress to hang or crash, disrupting normal operations and denying access to legitimate users. Services relying on Commons Compress for file compression and decompression tasks would be affected.

Luckily, developers have addressed this issue in Commons Compress version 1.26.0. All users are highly recommended to upgrade to the latest version as soon as possible to protect themselves against potential DoS attacks exploiting this vulnerability. Proper upgrade of third-party libraries is important for any application using compression functionality to ensure security and stability.