CVE-2024-26308

MEDIUM5.5EPSS 0.40%

Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

Published: 2/19/2024Modified: 2/4/2026

Also known as:GHSA-4265-ccf5-phj5CGA-f856-5ccw-92g2

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

Affected packages (2)

Debian/libcommons-compress-javafrom 0
Maven/org.apache.commons:commons-compress>= 1.21, < 1.26.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-26308
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2024-26308
PATCHhttps://github.com/apache/commons-compress
WEBhttps://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg
WEBhttps://security.netapp.com/advisory/ntap-20240307-0009
WEBhttp://www.openwall.com/lists/oss-security/2024/02/19/2