diff --git a/apache-commons-compress.spec b/apache-commons-compress.spec
index 32a445063bbb7da6cfae2cbb6d41b3ea6c199ce6..2da7abec41e3a4ae360adf73c89fd9ed33803ef2 100644
--- a/apache-commons-compress.spec
+++ b/apache-commons-compress.spec
@@ -2,7 +2,7 @@
 %bcond_without bootstrap
 
 Name:           apache-commons-compress
-Version:        1.21
+Version:        1.26
 Release:        %{anolis_release}%{?dist}
 Summary:        Java API for working with compressed files and archivers
 License:        ASL 2.0
@@ -92,5 +92,8 @@ rm src/test/java/org/apache/commons/compress/archivers/tar/TarMemoryFileSystemTe
 %doc LICENSE.txt NOTICE.txt
 
 %changelog
+* Fri Jun 28 2024 pangqing <pangqing@uniontech.com> - 1.26-1
+- CVE-2024-26308 and CVE-2024-25710
+
 * Mon Mar 27 2023 Chunmei Xu <xuchunmei@linux.alibaba.com> - 1.21-1
 - init from upstream
diff --git a/commons-compress-1.21-src.tar.gz b/commons-compress-1.21-src.tar.gz
deleted file mode 100644
index 1f21f61a6e8a0fb823bf4ffb46bbb8d9bf55e18c..0000000000000000000000000000000000000000
Binary files a/commons-compress-1.21-src.tar.gz and /dev/null differ
diff --git a/commons-compress-1.26-src.tar.gz b/commons-compress-1.26-src.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..3b82d6c8cf17e8a6fa116ac39db5f7aa0ff4e48c
Binary files /dev/null and b/commons-compress-1.26-src.tar.gz differ