Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.
Users are recommended to upgrade to version 1.26, which fixes the issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution existsUpgrade libcommons-compress-java | May 15, 2025 | Feb 19, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 36781850 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 36805124 for version 12.2.1.4.0. | Apr 25, 2024 | Feb 19, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.7Upgrade Splunk Enterprise to version 9.2.4Upgrade Splunk Enterprise to version 9.3.2 | Jul 30, 2026 | Feb 19, 2024 |
| Suse | — | Upgrade maven-doxia-module-confluenceUpgrade maven-resolver-javadocUpgrade maven-doxia-module-xhtml5Upgrade maven-jar-pluginUpgrade maven-assembly-pluginUpgrade maven-javadoc-pluginUpgrade maven-doxia-module-rtfUpgrade apache-commons-io-javadocUpgrade maven-doxia-module-fmlUpgrade apache-commons-ioUpgrade maven-doxia-module-docbook-simpleUpgrade xmvn-resolveUpgrade apache-commons-codecUpgrade maven-reporting-implUpgrade maven-jar-plugin-bootstrapUpgrade xmvn-installUpgrade maven-resolver-test-utilUpgrade xmvn-coreUpgrade maven-doxia-test-docsUpgrade maven-jar-plugin-javadocUpgrade gradle-localUpgrade maven-doxia-module-twikiUpgrade xmvnUpgrade maven-resources-plugin-bootstrapUpgrade maven-reporting-impl-javadocUpgrade apache-commons-compressUpgrade maven-javadoc-plugin-javadocUpgrade maven-resolver-transport-classpathUpgrade xmvn-mojoUpgrade maven-resolver-connector-basicUpgrade maven-doxia-module-foUpgrade maven-resources-plugin-javadocUpgrade ivy-localUpgrade maven-libUpgrade maven-doxia-sink-apiUpgrade maven-resolver-transport-fileUpgrade xmvn-substUpgrade maven-doxia-module-xdocUpgrade maven-resources-pluginUpgrade maven-localUpgrade maven-doxia-sitetools-javadocUpgrade apache-commons-configuration2-javadocUpgrade apache-commons-configuration2Upgrade apache-commons-codec-javadocUpgrade maven-resolver-spiUpgrade maven-resolverUpgrade maven-resolver-transport-wagonUpgrade maven-doxia-logging-apiUpgrade apache-commons-compress-javadocUpgrade maven-reporting-api-javadocUpgrade xmvn-mojo-javadocUpgrade maven-resolver-named-locksUpgrade maven-doxia-sitetoolsUpgrade maven-resolver-apiUpgrade maven-doxia-module-xhtmlUpgrade mavenUpgrade xmvn-parentUpgrade xmvn-minimalUpgrade maven-javadocUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-resolver-implUpgrade maven-doxia-coreUpgrade xmvn-apiUpgrade maven-resolver-utilUpgrade maven-doxia-module-aptUpgrade xmvn-tools-javadocUpgrade maven-doxia-javadocUpgrade sbt-bootstrapUpgrade maven-assembly-plugin-javadocUpgrade maven-resolver-transport-httpUpgrade maven-reporting-apiUpgrade maven-doxia-module-latexUpgrade xmvn-connector-javadocUpgrade sbtUpgrade xmvn-connector | Mar 1, 2024 | Feb 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub