Skip to content
Fencer Vulns
medium 5.5

CVE-2024-26308 json

Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

published 2024-02-19 2 y ago modified 2026-09-10 1 mo ago also GHSA-4265-ccf5-phj5 , EUVD-2024-0498

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.

Users are recommended to upgrade to version 1.26, which fixes the issue.

Patch / fix

  • maven org.apache.commons:commons-compress 1.26.0
  • Apache Software Foundation Apache Commons Compress 1.26.0
  • libcommons-compress-java Debian 14, Debian 13 1.27.1-1

debian advisories DEBIAN-CVE-2024-26308

  • sbt SLE Module for Package Hub 15 SP5, openSUSE Leap 15.5 0.13.18-150200.4.19.7
  • xmvn SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +10 more 4.2.0-150200.3.18.1
  • maven SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +10 more 3.9.6-150200.4.21.2
  • xmvn-mojo SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +10 more 4.2.0-150200.3.18.1
  • xmvn-tools SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +10 more 4.2.0-150200.3.18.1
  • maven-doxia SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +10 more 1.12.0-150200.4.7.2
  • xmvn-parent openSUSE Leap 15.5 4.2.0-150200.3.18.1
  • sbt-bootstrap SLE Module for Package Hub 15 SP5, openSUSE Leap 15.5 0.13.18-150200.4.19.7

suse advisories SUSE-SU-2024:0726-1

  • apache-commons-compress openSUSE Tumbleweed 1.26.0-1.1

opensuse advisories openSUSE-SU-2024:13702-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-26308 updated cvss 5.5

commons-compress: OutOfMemoryError unpacking broken Pack200 file

  • Red Hat Cryostat 2 commons-compress
    affected: workaround, no fix available “No mitigation is currently available for this vulnerability.”
  • Red Hat Ansible Automation Platform 2 commons-compress
    affected: workaround, no fix planned “No mitigation is currently available for this vulnerability.”
  • Red Hat build of Apache Camel 4 for Quarkus 3 commons-compress Red Hat build of Apache Camel for Spring Boot 4 commons-compress Red Hat Fuse 7 commons-compress
    affected: workaround, no fix available “No mitigation is currently available for this vulnerability.”
  • Red Hat Integration Camel K 1 commons-compress
    affected: workaround, no fix planned “No mitigation is currently available for this vulnerability.”
  • Red Hat Integration Camel Quarkus 2 commons-compress
    affected: workaround, no fix available “No mitigation is currently available for this vulnerability.”
  • Red Hat JBoss Data Grid 7 commons-compress Red Hat JBoss Fuse Service Works 6 commons-compress Red Hat Process Automation 7 apache-commons-compress Red Hat Single Sign-On 7 commons-compress Red Hat support for Spring Boot commons-compress
    affected: workaround, no fix planned “No mitigation is currently available for this vulnerability.”
  • Red Hat CEQ 3.2
    fixed: vendor fix “No mitigation is currently available for this vulnerability.” RHSA-2024:1706
  • Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-rhel8-operator 1.2-11, mtr/mtr-operator-bundle 1.2-18, mtr/mtr-web-container-rhel8 1.2-12, mtr/mtr-web-executor-container-rhel8 1.2-10
    fixed: vendor fix “No mitigation is currently available for this vulnerability.” RHSA-2024:1923
show 8 more
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-windup-addon-rhel9 6.2.3-2
    fixed: vendor fix “No mitigation is currently available for this vulnerability.” RHSA-2024:3989
  • Red Hat AMQ Broker 7.13.0
    fixed: vendor fix “No mitigation is currently available for this vulnerability.” RHSA-2025:7625
  • Red Hat build of Quarkus 2.13.9.SP2 commons-compress 1.26.1.redhat-00001
    fixed: vendor fix “No mitigation is currently available for this vulnerability.” RHSA-2024:1797
  • Red Hat build of Quarkus 3.2.11.Final commons-compress 1.26.0.redhat-00001
    fixed: vendor fix “No mitigation is currently available for this vulnerability.” RHSA-2024:1662
  • Red Hat Data Grid
    fixed: vendor fix “No mitigation is currently available for this vulnerability.” RHSA-2024:1509
  • Red Hat OpenShift Serverless 1.33 openshift-serverless-1/logic-rhel8-operator 1.33.0-3, openshift-serverless-1/logic-operator-bundle 1.33.0-5, openshift-serverless-1/logic-swf-builder-rhel8 1.33.0-5, openshift-serverless-1/logic-swf-devmode-rhel8 1.33.0-5, openshift-serverless-1/logic-data-index-ephemeral-rhel8 1.33.0-5, openshift-serverless-1/logic-data-index-postgresql-rhel8 1.33.0-5, +3 more
    fixed: vendor fix “No mitigation is currently available for this vulnerability.” RHSA-2024:4057
  • Red Hat RHINT Service Registry 2.5.11 GA
    fixed: vendor fix “No mitigation is currently available for this vulnerability.” RHSA-2024:2833
  • Red Hat A-MQ Clients 2 commons-compress Red Hat Logging Subsystem for Red Hat OpenShift org.elasticsearch-elasticsearch Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.3-2, mta/mta-hub-rhel9 6.2.3-1, mta/mta-rhel8-operator 6.2.3-1, mta/mta-operator-bundle 6.2.3-4, mta/mta-pathfinder-rhel9 6.2.3-1 Red Hat AMQ Clients commons-compress Red Hat build of Apache Camel for Spring Boot 3 commons-compress Red Hat build of Debezium 2 commons-compress
    +10 more products
    Red Hat Build of Keycloak commons-compress Red Hat build of OptaPlanner 8 commons-compress Red Hat build of Quarkus 2.13.9.SP2 jna 5.8.0, bson 4.7.2, db2 1.17.3, h2 2.1.214, hppc 0.8.1, jansi 1.18, +986 more Red Hat build of Quarkus 3.2.11.Final jna 5.8.0, lit 2.7.4, bson 4.9.1, db2 1.18.3, h2 2.2.220, jdom 1.1.3, +1046 more Red Hat JBoss Enterprise Application Platform 7 commons-compress Red Hat JBoss Enterprise Application Platform 8 commons-compress Red Hat JBoss Enterprise Application Platform Expansion Pack commons-compress Red Hat JBoss Web Server 5 commons-compress Red Hat JBoss Web Server 6 commons-compress Red Hat streams for Apache Kafka commons-compress
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.90% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.commons:commons-compress
>=1.21, <1.26.0
1.26.0

Affected products

  • Apache Software Foundation Apache Commons Compress

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.