shield Security update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni

SUSE-SLE-Module-Basesystem-15-SP7-2026-3225

This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue Security issues fixed: - CVE-2026-26032: improper pathname limitation in `PackagerResolver` allows for arbitrary files writes outside of the configured `buildRoot` directory (bsc#1271727). Other updates and bugfixes: - Update `apache-commons-compress` to 1.28.0. - Update `apache-ivy` to 2.6.0. - Include `brotli-java` and update to 1.2.0. - Include `zstd-jni` and update to v1.5.7.11.

Release Date

Jul 23 2026
References

Bugzilla: 1269480, 1271727
CVEs: CVE-2026-26032
Type

security
Severity

moderate

cloud_download Downloads

To download packages, you need to log in and have a valid subscription.

Basesystem Module 15.7 s390x

Packages

apache-commons-compress
Java API for working with compressed files and archivers

1.28.0-150200.3.19.1 lock rpm lock src

Basesystem Module 15.7 aarch64

Packages

apache-commons-compress
Java API for working with compressed files and archivers

1.28.0-150200.3.19.1 lock rpm lock src

Basesystem Module 15.7 x86_64

Packages

apache-commons-compress
Java API for working with compressed files and archivers

1.28.0-150200.3.19.1 lock rpm lock src

Basesystem Module 15.7 ppc64le

Packages

apache-commons-compress
Java API for working with compressed files and archivers

1.28.0-150200.3.19.1 lock rpm lock src