UpHeron
All vulnerabilities

Servers and applications

CVE-2018-11771

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip…

Severity
Medium 5.5
Published
16 Aug 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
5.3% in the next 30 daysHigher than 92% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Oracle WebLogic ServerServers and applications · cpe:a:oracle:weblogic_server
  • Version 14.1.1.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-11771
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-11771