CVE-2024-26308

Name	CVE-2024-26308
Description	Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1064414

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libcommons-compress-java (PTS)	bullseye	1.20-1	fixed
	bookworm	1.22-1	vulnerable
	sid, trixie	1.27.1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
libcommons-compress-java	source	buster	(not affected)
libcommons-compress-java	source	bullseye	(not affected)
libcommons-compress-java	source	(unstable)	1.27.1-1	1064414

Notes

[bookworm] - libcommons-compress-java <no-dsa> (Minor issue)
[bullseye] - libcommons-compress-java <not-affected> (Vulnerable code introduced later)
[buster] - libcommons-compress-java <not-affected> (Vulnerable code introduced later)
https://www.openwall.com/lists/oss-security/2024/02/19/2