Read the docs
TI-2024-17389 Aliases CVE-2024-26308GHSA-4265-ccf5-phj5

Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

Priority LOW 27CWE-770Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 9 fixed, 12 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00898 59th percentileScored 2026-11-07
Fix Partial Apache Commons Compress (Apache Software Foundation): 1.26.0org.apache.commons:commons-compress (Maven): 1.26.0Red Hat: 9 advisoriesRed Hat: 9 fixed, 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Commons Compress1.21 to before 1.26.01.26.0Patch availableCNA
—org.apache.commons:commons-compress (Maven)1.21 to before 1.26.01.26.0Patch availableGHSA-4265-ccf5-phj5
  • Apache Commons Compress VendorApache Affected 1.21 to before 1.26.0 Fixed in 1.26.0 Patch available CNA
  • org.apache.commons:commons-compress (Maven) Vendor— Affected 1.21 to before 1.26.0 Fixed in 1.26.0 Patch available GHSA-4265-ccf5-phj5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:*1.21 to before 1.26.0VulnerableApache
  • cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:* Versions 1.21 to before 1.26.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Commons Compress (Apache Software Foundation) Fixed in 1.26.0
  • Fix · GHSA-4265-ccf5-phj5 org.apache.commons:commons-compress (Maven) Fixed in 1.26.0 Advisory →

Red Hat 9 advisories

  • RHSA-2025:7625 Released 2025-05-14 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.13.0 release and security update
    • Red Hat AMQ Broker 7.13.0
  • RHSA-2024:4057 Released 2024-06-24 · Red Hat rating Important
    Release of OpenShift Serverless Logic 1.33.0 security update & enhancements
    • Red Hat OpenShift Serverless 1.33 openshift-serverless-1/logic-data-index-ephemeral-rhel8, openshift-serverless-1/logic-data-index-postgresql-rhel8, openshift-serverless-1/logic-jobs-service-ephemeral-rhel8 +6
  • RHSA-2024:3989 Released 2024-06-20 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 6.2 for RHEL 8 mta/mta-ui-rhel9, mta/mta-windup-addon-rhel9
Show 6 more Red Hat advisories
  • RHSA-2024:2833 Released 2024-05-14 · Red Hat rating Moderate
    Service Registry (container images) release and security update [2.5.11 GA]
    • RHINT Service Registry 2.5.11 GA
  • RHSA-2024:1797 Released 2024-04-22 · Red Hat rating Important
    Red Hat build of Quarkus 2.13.9.SP2 release and security update
    • Red Hat build of Quarkus 2.13.9.SP2 org.apache.commons.commons-compress-1.26.1.redhat-00001.jar, org.postgresql.postgresql-42.5.6.redhat-00001.jar
  • RHSA-2024:1923 Released 2024-04-18 · Red Hat rating Moderate
    Migration Toolkit for Runtimes security, bug fix and enhancement update
    • Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-operator-bundle, mtr/mtr-rhel8-operator, mtr/mtr-web-container-rhel8 +1
  • RHSA-2024:1706 Released 2024-04-09 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.0 for Quarkus 3.2 is now available (updates to RHBQ 3.2.11)
    • CEQ 3.2
  • RHSA-2024:1662 Released 2024-04-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.2.11 release and security update
    • Red Hat build of Quarkus 3.2.11.Final io.quarkus.quarkus-kubernetes-deployment-3.2.11.Final-redhat-00001.jar, io.quarkus.quarkus-resteasy-reactive-3.2.11.Final-redhat-00001.jar, io.vertx.vertx-core-4.4.8.redhat-00001.jar +2
  • RHSA-2024:1509 Released 2024-03-26 · Red Hat rating Moderate
    Red Hat Data Grid 8.4.7 security update
    • Red Hat Data Grid

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 2AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix yet
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat Integration Camel Quarkus 2AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
Red Hat support for Spring BootAffectedNo fix planned: Will not fix
CEQ 3.2Fixed RHSA-2024:1706
MTA 6.2 for RHEL 8Fixed RHSA-2024:3989
Migration Toolkit for Runtimes 1 on RHEL 8Fixed RHSA-2024:1923
RHINT Service Registry 2.5.11 GAFixed RHSA-2024:2833
Red Hat AMQ Broker 7.13.0Fixed RHSA-2025:7625
Red Hat Data GridFixed RHSA-2024:1509
Red Hat OpenShift Serverless 1.33Fixed RHSA-2024:4057
Red Hat build of Quarkus 2.13.9.SP2Fixed RHSA-2024:1797
Red Hat build of Quarkus 3.2.11.FinalFixed RHSA-2024:1662
Not affected: 16 products
  • A-MQ Clients 2
  • Logging Subsystem for Red Hat OpenShift
  • MTA 6.2 for RHEL 8
  • Red Hat AMQ Clients
  • Red Hat Build of Keycloak
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Web Server 5
  • Red Hat JBoss Web Server 6
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of Debezium 2
  • Red Hat build of OptaPlanner 8
  • Red Hat build of Quarkus 2.13.9.SP2
  • Red Hat build of Quarkus 3.2.11.Final
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-26308
  2. 2026-10-03 Alias added: GHSA-4265-ccf5-phj5

References

Advisory 4

Other 2

  • TI-2021-14540 Apache Commons Compress 1.0 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
  • TI-2021-14251 Apache Commons Compress 1.1 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-09249 Infinite loop in Apache Commons Compress CVSS 3.1HIGH 7.5
  • TI-2021-14250 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
  • TI-2021-14249 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability CVSS 3.1HIGH 7.5
  • TI-2012-01871 Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing… CVSS 2.0MEDIUM 5.0
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences