CVE-2024-26308: Apache Commons Compress

Medium severity, CVSS 5.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

Affected products

• Apache Commons Compress: from 1.21, before 1.26.0 (fixed in 1.26.0)

Published 2024-02-19. Last modified 2026-06-17.