code:

    if (path.startsWith("/META-INF/")) {
      // start at 4th separator
      int index = StringUtils.ordinalIndexOf(path, separator, 4);
      path = path.substring(index);
    }

StringUtils.ordinalIndexOf directly retrieves the separator's occurrence for the fourth time. If there are only three path separators, it will result in an index of -1, leading to an 'out of range' error when substring is called.

Example path: /META-INF/quercus/com.caucho.quercus.QuercusClass

The simplest fix:

if (path.startsWith("/META-INF/")) {
    // start at 4th separator
    if(StringUtils.countMatches(path, separator) >= 4){
        int index = StringUtils.ordinalIndexOf(path, separator, 4);
        path = path.substring(index);
    }
}

However, this fix method is not rigorous. It is still necessary to determine whether it is a multi-release JAR to ensure the correct parsing of data.