CVE-2021-36373: Uncontrolled Resource Consumption

July 14, 2021 (updated November 7, 2023)

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant.

References

ant.apache.org/security.html
nvd.nist.gov/vuln/detail/CVE-2021-36373

Detect and mitigate CVE-2021-36373 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →