CVE-2024-26308

2024-02-1909:15:38

Google

osv.dev

apache commons compress

vulnerability

resource allocation

upgrade

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

25.9%

JSON

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.

Users are recommended to upgrade to version 1.26, which fixes the issue.

CPENameOperatorVersion
commons-compresseqrel/1.22
commons-compresseq1.21-RC1
commons-compresseqrel/1.21
commons-compresseqrel/commons-compress-1.23.0
commons-compresseqcommons-compress-1.22-RC1
commons-compresseqcommons-compress-1.24.0-RC1
commons-compresseqrel/commons-compress-1.25.0
commons-compresseqcommons-compress-1.23.0-RC1
commons-compresseqcommons-compress-1.22
commons-compresseqcommons-compress-1.25.0-RC1

Name	Operator	Version
commons-compress	eq	rel/1.22
commons-compress	eq	1.21-RC1
commons-compress	eq	rel/1.21
commons-compress	eq	rel/commons-compress-1.23.0
commons-compress	eq	commons-compress-1.22-RC1
commons-compress	eq	commons-compress-1.24.0-RC1
commons-compress	eq	rel/commons-compress-1.25.0
commons-compress	eq	commons-compress-1.23.0-RC1
commons-compress	eq	commons-compress-1.22
commons-compress	eq	commons-compress-1.25.0-RC1