Vulnerability record · CVE-2024-26308 · published 19 February 2024

CVE-2024-26308: Apache commons compress allocation without limits vulnerability

Apache · Commons Compress

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

5.5 CVSS 3.1 Medium EPSS 0.90% · top 42.0% CWE-770 · Allocation without limits

5.5CVSS 3.1 base score

0.90%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Commons Compress Apache

References

Link	Tags
http://www.openwall.com/lists/oss-security/2024/02/19/2	Mailing ListThird Party Advisory
https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240307-0009/	Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/02/19/2	Mailing ListThird Party Advisory
https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240307-0009/	Third Party Advisory

Track CVE-2024-26308 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2021-35515Apache commons compress vulnerabilityWhen reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This cou…EPSS 12%13 Jul 2021 7.5CVE-2021-35516Apache commons compress allocation without limits vulnerabilityWhen reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error ev…EPSS 12%13 Jul 2021 7.5CVE-2021-35517Apache commons compress allocation without limits vulnerabilityWhen reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error e…EPSS 11%13 Jul 2021 7.5CVE-2021-36090Apache commons compress vulnerabilityWhen reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error e…EPSS 13%13 Jul 2021 7.5CVE-2019-12402Apache commons compress vulnerabilityThe file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially craf…EPSS 16%30 Aug 2019 5.5CVE-2024-25710Apache commons compress vulnerabilityLoop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 …EPSS 0.44%19 Feb 2024 5.5CVE-2023-42503Apache commons compress improper input validation vulnerabilityImproper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Common…EPSS 0.60%14 Sep 2023 5.5CVE-2018-11771Apache commons compress vulnerabilityWhen reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the c…EPSS 5.3%16 Aug 2018

Source: NIST National Vulnerability Database (record CVE-2024-26308), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.