{
  "cveId": "CVE-2018-11771",
  "url": "https://patchblox.com/security/cve/CVE-2018-11771",
  "summary": "CVE-2018-11771 is fixed in libcommons-compress-java on 1 platform, first by libcommons-compress-java 1.18-1, released January 16, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libcommons-compress-java: When reading a specially crafted ZIP archive, the read method of ApacheCommons Compress 1.7 to 1.17\u0027s ZipArchiveInput...",
  "description": "When reading a specially crafted ZIP archive, the read method of ApacheCommons Compress 1.7 to 1.17\u0027s ZipArchiveInputStream can fail to return thecorrect EOF indication after the end of the stream has been reached. Whencombined with a java.io.InputStreamReader this can lead to an infinitestream, which can be used to mount a denial of service attack againstservices that use Compress\u0027 zip package.",
  "severity": "Low",
  "epss": 0.05253,
  "epssPercentile": 0.9259,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libcommons-compress-java",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.18-1",
      "fix": "libcommons-compress-java 1.18-1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libcommons-compress-java-1.18-1",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "libcommons-compress-java",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "1.18-1",
      "fix": "libcommons-compress-java 1.18-1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libcommons-compress-java-1.18-1",
      "released": "2026-01-16T01:42:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}