Description
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.
Users are recommended to upgrade to version 1.26, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Commons Compress | 1.21 – < 1.26.0 | 1.26.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-compress-java | 1.27.1-1 | — |
| Debian 13 | libcommons-compress-java | 1.27.1-1 | — |
| Debian 12 | libcommons-compress-java | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libcommons-compress-java | No fix yet | — |
| Ubuntu 26.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 25.10 | libcommons-compress-java | No fix yet | — |
| Ubuntu 24.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 22.04 LTS | libcommons-compress-java | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 18.04 LTS | libcommons-compress-java | No fix yet | — |
| Ubuntu 16.04 LTS | libcommons-compress-java | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | maven-jar-plugin | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | maven-javadoc-plugin | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | maven-resources-plugin | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | sbt +1 | 0.13.18-150200.4.19.7 | SUSE-SU-2024:0726-1 |
| SLES 15 SP5 | xmvn +3 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | maven-jar-plugin | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | maven-javadoc-plugin | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | maven-resources-plugin | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP4 | xmvn +3 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | maven-jar-plugin | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | maven-javadoc-plugin | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | maven-resources-plugin | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP3 | xmvn +3 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | maven-jar-plugin | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | maven-javadoc-plugin | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | maven-resources-plugin | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES 15 SP2 | xmvn +3 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | maven-jar-plugin | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | maven-javadoc-plugin | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | maven-resources-plugin | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP4 | xmvn +3 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | maven-jar-plugin | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | maven-javadoc-plugin | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | maven-resources-plugin | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP3 | xmvn +3 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | maven-jar-plugin | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | maven-javadoc-plugin | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | maven-resources-plugin | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLES for SAP 15 SP2 | xmvn +3 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | maven-jar-plugin | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | maven-javadoc-plugin | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | maven-resources-plugin | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP4 | xmvn +3 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | maven-jar-plugin | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | maven-javadoc-plugin | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | maven-resources-plugin | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP3 | xmvn +3 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | maven-jar-plugin | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | maven-javadoc-plugin | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | maven-resources-plugin | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SLE HPC 15 SP2 | xmvn +3 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
| SUSE Manager Server Module 4.3 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SUSE Manager Server Module 4.3 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SUSE Manager Server 4.3 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SUSE Manager Server 4.3 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SUSE Manager Proxy 4.3 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SUSE Manager Proxy 4.3 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | maven-jar-plugin | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | maven-javadoc-plugin | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | maven-resources-plugin | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| SUSE Enterprise Storage 7.1 | xmvn +3 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-compress | 1.26.0-1.1 | openSUSE-SU-2024:13702-1 |
| openSUSE Leap 15.5 | apache-commons-codec | 1.16.1-150200.3.9.1 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | apache-commons-compress | 1.26.0-150200.3.16.1 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | apache-commons-configuration2 | 2.9.0-150200.5.5.1 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | apache-commons-io | 2.15.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | javapackages-meta | 6.2.0-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | maven | 3.9.6-150200.4.21.2 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | maven-assembly-plugin | 3.6.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | maven-doxia | 1.12.0-150200.4.7.2 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | maven-doxia-sitetools | 1.11.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | maven-jar-plugin +1 | 3.3.0-150200.3.10.1 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | maven-javadoc-plugin +1 | 3.6.0-150200.4.10.1 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | maven-reporting-api | 3.1.1-150200.3.7.1 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | maven-reporting-impl | 3.2.0-150200.4.6.2 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | maven-resolver | 1.9.18-150200.3.17.2 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | maven-resources-plugin +1 | 3.3.1-150200.3.12.1 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | sbt +1 | 0.13.18-150200.4.19.7 | SUSE-SU-2024:0726-1 |
| openSUSE Leap 15.5 | xmvn +4 | 4.2.0-150200.3.18.1 | SUSE-SU-2024:0726-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | celeborn-0.6 | 0.6.3-r7 | — |
| Wolfi rolling | dependency-track +1 | 4.10.1-r2 | — |
| Wolfi rolling | druid | 34.0.0-r6 | — |
| Wolfi rolling | gradle-8 | 8.7.0-r1 | — |
| Wolfi rolling | gradle-stage0 | No fix yet | — |
| Wolfi rolling | opensearch-2 | 2.12.0-r1 | — |
| Wolfi rolling | spdx-tools-java | 1.1.8-r1 | — |
| Wolfi rolling | tez | 0.10.4-r6 | — |
| Wolfi rolling | trino +58 | 439-r2 | — |
| Wolfi rolling | wavefront-proxy +3 | 13.4-r3 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
crazycatMyopic/cve ★ 0 · Aug 11, 2024
Docker Deskop giving issue CVE-2024-26308 for maven [reproduce]
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.commons:commons-compress | >= 1.21, < 1.26.0 | 1.26.0 | GHSA-4265-ccf5-phj5 |
Advisories 35
- WID-SEC-2025-0135 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- WID-SEC-2024-1655 Oracle PeopleSoft: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-0414 Apache Commons: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-1637 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
- SUSE-SU-2024:0726-1 Security update for Java SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13702-1 apache-commons-compress-1.26.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3674 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- WID-SEC-2024-1360 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- WID-SEC-2024-0818 Red Hat Integration: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2024-0869 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 10, 2025
- WID-SEC-2025-1572 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2024-0899 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2025
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025
- WID-SEC-2025-0142 Oracle Health Sciences Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 21, 2025
- WID-SEC-2024-1642 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 20, 2024
- NCSC-2024-0418 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0415 Kwetsbaarheden verholpen in Oracle Enterprise Manager NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0413 Kwetsbaarheden verholpen in Oracle Commerce NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3193 Oracle Enterprise Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- WID-SEC-2024-3190 Oracle Hyperion: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- WID-SEC-2024-3197 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- NCSC-2024-0304 Kwetsbaarheden verholpen in Oracle PeopleSoft NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0298 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0297 Kwetsbaarheden verholpen in Oracle Financial Services Applications NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0294 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0292 Kwetsbaarheden verholpen in Oracle Essbase NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1659 Oracle Insurance Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-1654 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-1638 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-0870 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 22, 2024
- WID-SEC-2024-0873 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2024-0868 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024