CVE-2018-1324

—

CVSS 3.1

5.5 medium

EPSS

4%p89

Published

Mar 16, 2018 (Mar 16, 2018)

Modified

Jun 17, 2026

Description

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.

Vendors: apache oracle
Products: commons compress, mysql cluster, weblogic server
Weakness: CWE-835
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (3.7%)

In the news0 stories

No ingested article mentions this CVE yet.