Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.
Users are recommended to upgrade to version 1.26, which fixes the issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libcommons-compress-java | May 15, 2025 | Feb 19, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 36805124 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 36781850 for version 14.1.1.0.0. | Apr 25, 2024 | Feb 19, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.4Upgrade Splunk Enterprise to version 9.1.7Upgrade Splunk Enterprise to version 9.3.2 | Jul 30, 2026 | Feb 19, 2024 |
| Suse | — | Upgrade maven-doxia-logging-apiUpgrade xmvn-mojo-javadocUpgrade maven-doxia-module-latexUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-resolver-utilUpgrade xmvn-apiUpgrade maven-reporting-api-javadocUpgrade maven-resolver-transport-wagonUpgrade maven-resolver-implUpgrade xmvn-connector-javadocUpgrade apache-commons-compress-javadocUpgrade maven-doxia-module-aptUpgrade maven-reporting-apiUpgrade maven-javadocUpgrade maven-resources-pluginUpgrade maven-doxia-javadocUpgrade xmvn-connectorUpgrade maven-doxia-module-xdocUpgrade maven-doxia-module-xhtmlUpgrade maven-resolver-apiUpgrade maven-doxia-coreUpgrade sbtUpgrade xmvn-tools-javadocUpgrade xmvn-minimalUpgrade maven-resolver-named-locksUpgrade maven-localUpgrade apache-commons-configuration2Upgrade xmvn-parentUpgrade maven-doxia-sitetoolsUpgrade maven-resolver-transport-httpUpgrade maven-doxia-sitetools-javadocUpgrade maven-resolverUpgrade apache-commons-configuration2-javadocUpgrade maven-resolver-spiUpgrade apache-commons-codec-javadocUpgrade mavenUpgrade maven-assembly-plugin-javadocUpgrade sbt-bootstrapUpgrade xmvn-coreUpgrade maven-doxia-module-confluenceUpgrade maven-resolver-transport-classpathUpgrade maven-reporting-implUpgrade maven-doxia-module-fmlUpgrade apache-commons-codecUpgrade maven-doxia-module-docbook-simpleUpgrade maven-doxia-module-twikiUpgrade apache-commons-ioUpgrade maven-libUpgrade maven-resources-plugin-javadocUpgrade maven-resolver-transport-fileUpgrade xmvn-substUpgrade apache-commons-compressUpgrade xmvn-installUpgrade ivy-localUpgrade maven-reporting-impl-javadocUpgrade maven-doxia-module-xhtml5Upgrade maven-assembly-pluginUpgrade maven-jar-plugin-bootstrapUpgrade maven-resources-plugin-bootstrapUpgrade xmvnUpgrade maven-resolver-connector-basicUpgrade maven-doxia-sink-apiUpgrade maven-doxia-module-foUpgrade xmvn-mojoUpgrade xmvn-resolveUpgrade gradle-localUpgrade apache-commons-io-javadocUpgrade maven-resolver-test-utilUpgrade maven-resolver-javadocUpgrade maven-javadoc-pluginUpgrade maven-jar-plugin-javadocUpgrade maven-jar-pluginUpgrade maven-doxia-test-docsUpgrade maven-doxia-module-rtfUpgrade maven-javadoc-plugin-javadoc | Mar 1, 2024 | Feb 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub