CVE-2021-35517: 
Java vulnerability analysis and mitigation

CVE-2021-35517 is a vulnerability in Apache Commons Compress discovered by OSS Fuzz that affects versions 1.1 to 1.20. When reading a specially crafted TAR archive, the software can be made to allocate large amounts of memory that leads to an out of memory error even for very small inputs (OSS Security).

The vulnerability has a CVSS v3.1 Base Score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-130 (Improper Handling of Length Parameter Inconsistency) (NVD).

This vulnerability could be used to mount a denial of service attack against services that use Compress' tar package by causing out of memory errors even with very small malicious inputs (OSS Security).

The vulnerability is remotely exploitable without requiring authentication. An attacker can trigger the vulnerability by sending specially crafted TAR archives to services using the affected versions of Apache Commons Compress (NVD).

Users should upgrade to Apache Commons Compress version 1.21 or later which contains fixes for this vulnerability (OSS Security). Multiple vendors have released patches including Oracle in their Critical Patch Updates (Oracle Advisory) and NetApp in their security advisory (NetApp Advisory).