{
  "cveId": "CVE-2021-36090",
  "url": "https://patchblox.com/security/cve/CVE-2021-36090",
  "summary": "CVE-2021-36090 is fixed in 2 products on 1 platform, first by ALAS2023-2025-841, released February 11, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "apache-commons-compress: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2021-36090:\n\tWhen rea...",
  "description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2021-36090:\n\tWhen reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 zip package.",
  "published": "2025-02-11T23:13:00Z",
  "severity": "moderate",
  "epss": 0.12945,
  "epssPercentile": 0.96349,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "apache-commons-compress",
      "release": "amzn 2023",
      "fixedVersion": "1.21-4.amzn2023.0.3",
      "fix": "ALAS2023-2025-841",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-841",
      "released": "2025-02-11T23:13:00Z"
    },
    {
      "platform": "linux",
      "product": "apache-commons-compress-javadoc",
      "release": "amzn 2023",
      "fixedVersion": "1.21-4.amzn2023.0.3",
      "fix": "ALAS2023-2025-841",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-841",
      "released": "2025-02-11T23:13:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T01:44:33Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}