Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.
Users are recommended to upgrade to version 1.26, which fixes the issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libcommons-compress-java | May 15, 2025 | Feb 19, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 36805124 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 36781850 for version 14.1.1.0.0. | Apr 25, 2024 | Feb 19, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.7Upgrade Splunk Enterprise to version 9.2.4Upgrade Splunk Enterprise to version 9.3.2 | Jul 30, 2026 | Feb 19, 2024 |
| Suse | — | Upgrade maven-assembly-plugin-javadocUpgrade maven-resolver-apiUpgrade mavenUpgrade maven-doxia-coreUpgrade maven-doxia-module-aptUpgrade xmvn-mojo-javadocUpgrade maven-resolver-transport-httpUpgrade maven-resolver-utilUpgrade maven-doxia-logging-apiUpgrade xmvn-apiUpgrade maven-javadoc-plugin-bootstrapUpgrade apache-commons-compress-javadocUpgrade xmvn-parentUpgrade maven-doxia-javadocUpgrade maven-reporting-apiUpgrade xmvn-connector-javadocUpgrade maven-resolver-transport-wagonUpgrade maven-resolver-implUpgrade xmvn-minimalUpgrade maven-doxia-module-xdocUpgrade sbt-bootstrapUpgrade maven-reporting-api-javadocUpgrade maven-javadocUpgrade sbtUpgrade xmvn-connectorUpgrade maven-doxia-module-xhtmlUpgrade apache-commons-configuration2Upgrade apache-commons-configuration2-javadocUpgrade apache-commons-codec-javadocUpgrade maven-doxia-sitetools-javadocUpgrade maven-doxia-module-latexUpgrade maven-resolverUpgrade maven-resolver-spiUpgrade xmvn-tools-javadocUpgrade maven-doxia-sitetoolsUpgrade maven-resolver-named-locksUpgrade maven-localUpgrade maven-resources-pluginUpgrade maven-reporting-implUpgrade maven-doxia-module-fmlUpgrade maven-resolver-transport-fileUpgrade maven-doxia-module-docbook-simpleUpgrade apache-commons-io-javadocUpgrade apache-commons-ioUpgrade maven-doxia-module-foUpgrade xmvn-coreUpgrade apache-commons-compressUpgrade maven-resolver-javadocUpgrade maven-reporting-impl-javadocUpgrade xmvnUpgrade maven-resources-plugin-bootstrapUpgrade xmvn-resolveUpgrade maven-resolver-transport-classpathUpgrade maven-javadoc-plugin-javadocUpgrade xmvn-substUpgrade maven-resources-plugin-javadocUpgrade maven-libUpgrade xmvn-installUpgrade maven-jar-pluginUpgrade maven-doxia-module-xhtml5Upgrade maven-doxia-module-confluenceUpgrade maven-jar-plugin-bootstrapUpgrade maven-assembly-pluginUpgrade gradle-localUpgrade maven-javadoc-pluginUpgrade maven-doxia-test-docsUpgrade maven-doxia-module-twikiUpgrade maven-resolver-test-utilUpgrade maven-doxia-module-rtfUpgrade maven-jar-plugin-javadocUpgrade ivy-localUpgrade maven-doxia-sink-apiUpgrade maven-resolver-connector-basicUpgrade xmvn-mojoUpgrade apache-commons-codec | Mar 1, 2024 | Feb 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub