CVE-2024-26308: apache software foundation apache commons compress

CVSS: 5.5v3.1MediumModified

AliasesUBUNTU-CVE-2024-26308DEBIAN-CVE-2024-26308CGA-22gg-qrmg-9pqx+316 more

Published 19-02-2024Last modified 27-03-2025

Vulnerability summary

CVE-2024-26308 is a medium (CVSS 5.5) vulnerability in apache software foundation apache commons compress. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 58.8% of scored vulnerabilities.

Overall risk

22/100

0100

Low · default modelHow is this calculated?

CVSS score

5.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.90%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 14

OPENSUSE-SU-2024:13702-1 SUSE-SU-2024:0726-1 CGA-4QFQ-4JJG-V7X8 CGA-5JHG-GJX7-PQ4M CGA-96MQ-J5W6-4GC5 CGA-CM9W-HFX3-J2P6+8 more

Timeline

19-02-2024
PublishedVulnerability first disclosed.
27-03-2025
Last modifiedVulnerability information updated.

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

CVSS metrics

8 scores · 7 sources · 2 versions

v4.06.7v3.15.5

EPSS trend

Probability

0.90%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

0.00 pp

From 0.90% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.90%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Chainguard151 products

celeborn-0.5< 0.5.4-r26
celeborn-0.6< 0.6.3-r7
dependency-track< 4.10.1-r2
dependency-track-bundled< 4.10.1-r2
druid< 37.0.0-r56 | < 37.0.0-r14 | < 34.0.0-r6

eco-java-gradle-7.3All versions (No fix recorded)
eco-java-gradle-7.3.1All versions (No fix recorded)
eco-java-gradle-7.3.2All versions (No fix recorded)
eco-java-gradle-7.3.3All versions (No fix recorded)
eco-java-gradle-7.4All versions (No fix recorded)
eco-java-gradle-7.4.1All versions (No fix recorded)
eco-java-gradle-7.4.2All versions (No fix recorded)
eco-java-gradle-7.5All versions (No fix recorded)
eco-java-gradle-7.5.1All versions (No fix recorded)
eco-java-gradle-7.6All versions (No fix recorded)
eco-java-gradle-7.6.1All versions (No fix recorded)
eco-java-gradle-7.6.2All versions (No fix recorded)
eco-java-gradle-7.6.3All versions (No fix recorded)
eco-java-gradle-7.6.4All versions (No fix recorded)
eco-java-gradle-8.0All versions (No fix recorded)
eco-java-gradle-8.0.1All versions (No fix recorded)
eco-java-gradle-8.0.2All versions (No fix recorded)
eco-java-gradle-8.1All versions (No fix recorded)
eco-java-gradle-8.1.1All versions (No fix recorded)
eco-java-gradle-8.2All versions (No fix recorded)
eco-java-gradle-8.2.1All versions (No fix recorded)
eco-java-gradle-8.3All versions (No fix recorded)
eco-java-gradle-8.4All versions (No fix recorded)
eco-java-gradle-8.5All versions (No fix recorded)
eco-java-gradle-8.6All versions (No fix recorded)
eco-java-gradle-8.7All versions (No fix recorded)
gradle-8< 8.7.0-r1
gradle-stage0All versions (No fix recorded)
hadoop-client-modules< 3.3.6-r2
hadoop-fips-3.3.6All versions (No fix recorded) | < 3.3.6-r22
hadoop-fips-3.4.2< 3.4.2-r1 | All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded)
kayenta-2026.1< 2026.1.0-r1
kayenta-fips-2026.1< 2026.1.0-r1
opensearch-2< 2.12.0-r1
opensearch-2-alerting< 2.12.0-r1
opensearch-2-analysis-icu< 2.12.0-r1
opensearch-2-analysis-kuromoji< 2.12.0-r1
opensearch-2-analysis-nori< 2.12.0-r1
opensearch-2-analysis-phonetic< 2.12.0-r1
opensearch-2-analysis-smartcn< 2.12.0-r1
opensearch-2-analysis-stempel< 2.12.0-r1
opensearch-2-analysis-ukrainian< 2.12.0-r1
opensearch-2-anomaly-detection< 2.12.0-r1
opensearch-2-asynchronous-search< 2.12.0-r1
opensearch-2-cross-cluster-replication< 2.12.0-r1
opensearch-2-crypto-kms< 2.12.0-r1
opensearch-2-custom-codecs< 2.12.0-r1
opensearch-2-discovery-azure-classic< 2.12.0-r1
opensearch-2-discovery-ec2< 2.12.0-r1
opensearch-2-discovery-gce< 2.12.0-r1
opensearch-2-entrypoint-compat< 2.12.0-r1
opensearch-2-geospatial< 2.12.0-r1
opensearch-2-identity-shiro< 2.12.0-r1
opensearch-2-index-management< 2.12.0-r1
opensearch-2-ingest-attachment< 2.12.0-r1
opensearch-2-job-scheduler< 2.12.0-r1
opensearch-2-k-nn< 2.12.0-r1
opensearch-2-mapper-annotated-text< 2.12.0-r1
opensearch-2-mapper-murmur3< 2.12.0-r1
opensearch-2-mapper-size< 2.12.0-r1
opensearch-2-ml-commons< 2.12.0-r1
opensearch-2-neural-search< 2.12.0-r1
opensearch-2-notifications< 2.12.0-r1
opensearch-2-observability< 2.12.0-r1
opensearch-2-performance-analyzer< 2.12.0-r1
opensearch-2-reporting< 2.12.0-r1
opensearch-2-repository-azure< 2.12.0-r1
opensearch-2-repository-gcs< 2.12.0-r1
opensearch-2-repository-s3< 2.12.0-r1
opensearch-2-security< 2.12.0-r1
opensearch-2-security-analytics< 2.12.0-r1
opensearch-2-sql< 2.12.0-r1
opensearch-2-store-smb< 2.12.0-r1
opensearch-2-telemetry-otel< 2.12.0-r1
opensearch-2-transport-nio< 2.12.0-r1
rangerAll versions (No fix recorded)
spark-3.5-scala-2.12All versions (No fix recorded)
spark-3.5-scala-2.13All versions (No fix recorded)
spark-fips-3.5-scala-2.12All versions (No fix recorded)
spark-fips-3.5-scala-2.13All versions (No fix recorded)
spdx-tools-java< 1.1.8-r1
tez< 0.10.4-r6
trino< 439-r2
trino-config< 439-r2
trino-oci-entrypoint< 439-r2
trino-plugin-ai-functions< 439-r2
trino-plugin-bigquery< 439-r2
trino-plugin-blackhole< 439-r2
trino-plugin-cassandra< 439-r2
trino-plugin-clickhouse< 439-r2
trino-plugin-delta-lake< 439-r2
trino-plugin-druid< 439-r2
trino-plugin-duckdb< 439-r2
trino-plugin-elasticsearch< 439-r2
trino-plugin-exasol< 439-r2
trino-plugin-exchange-filesystem< 439-r2
trino-plugin-exchange-hdfs< 439-r2
trino-plugin-faker< 439-r2
trino-plugin-functions-python< 439-r2
trino-plugin-geospatial< 439-r2
trino-plugin-google-sheets< 439-r2
trino-plugin-hive< 439-r2
trino-plugin-http-event-listener< 439-r2
trino-plugin-http-server-event-listener< 439-r2
trino-plugin-hudi< 439-r2
trino-plugin-iceberg< 439-r2
trino-plugin-ignite< 439-r2
trino-plugin-jmx< 439-r2
trino-plugin-kafka< 439-r2
trino-plugin-kafka-event-listener< 439-r2
trino-plugin-lakehouse< 439-r2
trino-plugin-ldap-group-provider< 439-r2
trino-plugin-loki< 439-r2
trino-plugin-mariadb< 439-r2
trino-plugin-memory< 439-r2
trino-plugin-ml< 439-r2
trino-plugin-mongodb< 439-r2
trino-plugin-mysql< 439-r2
trino-plugin-mysql-event-listener< 439-r2
trino-plugin-opa< 439-r2
trino-plugin-openlineage< 439-r2
trino-plugin-opensearch< 439-r2
trino-plugin-oracle< 439-r2
trino-plugin-password-authenticators< 439-r2
trino-plugin-pinot< 439-r2
trino-plugin-postgresql< 439-r2
trino-plugin-prometheus< 439-r2
trino-plugin-ranger< 439-r2
trino-plugin-redis< 439-r2
trino-plugin-redshift< 439-r2
trino-plugin-resource-group-managers< 439-r2
trino-plugin-session-property-managers< 439-r2
trino-plugin-singlestore< 439-r2
trino-plugin-snowflake< 439-r2
trino-plugin-spooling-filesystem< 439-r2
trino-plugin-sqlserver< 439-r2
trino-plugin-teradata-functions< 439-r2
trino-plugin-thrift< 439-r2
trino-plugin-tpcds< 439-r2
trino-plugin-tpch< 439-r2
trino-plugin-vertica< 439-r2
wavefront-proxy< 13.4-r3
wavefront-proxy-compat< 13.4-r3
wavefront-proxy-config< 13.4-r3
wavefront-proxy-licenses< 13.4-r3

Show all 151

Wolfi47 products

celeborn-0.6< 0.6.3-r7
dependency-track< 4.10.1-r2
dependency-track-bundled< 4.10.1-r2
druid< 37.0.0-r56 | < 37.0.0-r14 | < 34.0.0-r6
gradle-8< 8.7.0-r1

Show all 47

Apache1 product

commons_compress≥ 1.21, < 1.26.0

Apache software foundation1 product

apache commons compress≥ 1.21, < 1.26.0

4 vendors · 200 products · Showing 200 of 228. Use Open JSON for the complete list.

References

12 links

lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfgVendor AdvisoryREPORTAdvisoryWEB
www.openwall.com/lists/oss-security/2024/02/19/2REPORTWEBMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20240307-0009/AdvisoryThird Party Advisory
ubuntu.com/security/CVE-2024-26308REPORT
www.openwall.com/lists/oss-security/2024/02/19/2REPORT
www.cve.org/CVERecord?id=CVE-2024-26308REPORT
security-tracker.debian.org/tracker/CVE-2024-26308Advisory
repo.maven.apache.org/maven2/WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26308.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2024-26308Advisory

Show all 12 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities