PT-2023-5202 · Apache+2 · Apache Commons Compress+2

Yakov Shafranovich · Published 2023-09-11 · Updated 2026-05-18 · CVE-2023-42503

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Commons Compress versions 1.22 through 1.23

Description The issue is related to uncontrolled resource consumption due to insufficient input validation when processing TAR archive headers. This can be exploited by a remote attacker to cause a denial of service. The estimated number of potentially affected devices is not specified.

Recommendations For Apache Commons Compress versions 1.22 through 1.23, update to version 1.24.0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of TAR archives from untrusted sources to minimize the risk of exploitation.

Fix

DoS

Improper Resource Release

Resource Exhaustion

RCE

Weakness Enumeration

CWE-404

CWE-400

CWE-20

Related Identifiers

BDU:2023-05808

CLEANSTART-2026-SQ91016

CLEANSTART-2026-WK99982

CVE-2023-42503

GHSA-CGWF-W82Q-5JRR

Affected Products

Apache Commons Compress

Debian

Red Os

References · 159

• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-42503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-27821 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-55163 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20863 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38808 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-67735 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42503 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-42503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20861 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-13009 · Security Note