CVE-2024-26308: Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress: from 1.21 before 1.26.
Users are recommended to upgrade to version 1.26, which fixes the issue.
Other sources
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.
Users are recommended to upgrade to version 1.26, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.commons:commons-compressto a version that resolves this vulnerability.Fixed in 1.26.0 - Upgrade
Upgrade
redhat/Apache Commons Compressto a version that resolves this vulnerability.Fixed in 1.26 - Upgrade
Upgrade
Apache Commons Compressto a version that resolves this vulnerability.Fixed in 1.26.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26308?
The severity of CVE-2024-26308 is currently classified as moderate.
How do I fix CVE-2024-26308?
To fix CVE-2024-26308, upgrade Apache Commons Compress to version 1.26.0 or later.
What software is affected by CVE-2024-26308?
CVE-2024-26308 affects Apache Commons Compress versions between 1.21 and 1.26.0, as well as associated products like IBM Security Verify Governance 10.0.2 and earlier.
What type of vulnerability is reported in CVE-2024-26308?
CVE-2024-26308 represents an infinite loop vulnerability that can lead to denial of service.
Are there any known exploits for CVE-2024-26308?
As of now, no public exploits for CVE-2024-26308 have been reported.