# How to update Apache Commons Compress in nexus

## post by slv_b on Jul 3, 2024

Cybersecurity staff discovered that the version of Apache Commons Compress, which is used even in the latest Nexus release, is susceptible to vulnerabilities CVE-2024-26308 and CVE-2024-25710.

Does anyone know how to correctly update the version of Apache Commons Compress?

So far nothing smart comes to mind except how to replace the original file

`system/org/apache/commons/commons-compress/1.21/commons-compress-1.21.jar`

to a new one, renaming the new one to 1.21.

And I know that in latest version of Nexus version of commons-compress is 1.24, but Fixed version: 1.26.0

Additional info

[https://mvnrepository.com/artifact/org.apache.commons/commons-compress/1.24.0](https://mvnrepository.com/artifact/org.apache.commons/commons-compress/1.24.0)

## post by mpiggott on Jul 8, 2024

The next release 3.70 will contain an updated version of the library.

### New & Unread Topics

| Topic | Replies | Views | Activity |
| --- | --- | --- | --- |
| [Cannot create Maven - Delete SNAPSHOT Task](https://community.sonatype.com/t/cannot-create-maven-delete-snapshot-task/15605) | [2](https://community.sonatype.com/t/cannot-create-maven-delete-snapshot-task/15605/1) | 80 | [Sep 2025](https://community.sonatype.com/t/cannot-create-maven-delete-snapshot-task/15605/3) |
| [Nexus Repository 3.85](https://community.sonatype.com/t/nexus-repository-3-85/15732) | [2](https://community.sonatype.com/t/nexus-repository-3-85/15732/1) | 152 | [Nov 2025](https://community.sonatype.com/t/nexus-repository-3-85/15732/3) |
| [Spin up new Nexus instance from scratch - Task Execute Data Repair Plan stops after 0 seconds](https://community.sonatype.com/t/spin-up-new-nexus-instance-from-scratch-task-execute-data-repair-plan-stops-after-0-seconds/15746) | [2](https://community.sonatype.com/t/spin-up-new-nexus-instance-from-scratch-task-execute-data-repair-plan-stops-after-0-seconds/15746/1) | 125 | [Nov 2025](https://community.sonatype.com/t/spin-up-new-nexus-instance-from-scratch-task-execute-data-repair-plan-stops-after-0-seconds/15746/3) |
| [Proxied Docker Repository failling to pull images](https://community.sonatype.com/t/proxied-docker-repository-failling-to-pull-images/15767) | [0](https://community.sonatype.com/t/proxied-docker-repository-failling-to-pull-images/15767/1) | 131 | [Nov 2025](https://community.sonatype.com/t/proxied-docker-repository-failling-to-pull-images/15767/1) |
| [Failed to make connection to backend after upgrade to nexus 3.78.2](https://community.sonatype.com/t/failed-to-make-connection-to-backend-after-upgrade-to-nexus-3-78-2/15348) | [1](https://community.sonatype.com/t/failed-to-make-connection-to-backend-after-upgrade-to-nexus-3-78-2/15348/1) | 180 | [Oct 2025](https://community.sonatype.com/t/failed-to-make-connection-to-backend-after-upgrade-to-nexus-3-78-2/15348/2) |