diff --git a/apache-commons-compress.spec b/apache-commons-compress.spec
index 32a445063bbb7da6cfae2cbb6d41b3ea6c199ce6..d533974f6f53c5c5fc6d1ad64fcaca6babc44b08 100644
--- a/apache-commons-compress.spec
+++ b/apache-commons-compress.spec
@@ -2,7 +2,7 @@
 %bcond_without bootstrap
 
 Name:           apache-commons-compress
-Version:        1.21
+Version:        1.26.0
 Release:        %{anolis_release}%{?dist}
 Summary:        Java API for working with compressed files and archivers
 License:        ASL 2.0
@@ -92,5 +92,8 @@ rm src/test/java/org/apache/commons/compress/archivers/tar/TarMemoryFileSystemTe
 %doc LICENSE.txt NOTICE.txt
 
 %changelog
+* Thu Aug 14 2025 wh02252983 <wh02252983@alibaba-inc.com> - 1.26.0-1
+- update to 1.26.0 to fix CVE-2024-25710 and CVE-2024-26308
+
 * Mon Mar 27 2023 Chunmei Xu <xuchunmei@linux.alibaba.com> - 1.21-1
 - init from upstream
diff --git a/commons-compress-1.21-src.tar.gz b/commons-compress-1.21-src.tar.gz
deleted file mode 100644
index 1f21f61a6e8a0fb823bf4ffb46bbb8d9bf55e18c..0000000000000000000000000000000000000000
Binary files a/commons-compress-1.21-src.tar.gz and /dev/null differ
diff --git a/commons-compress-1.26.0-src.tar.gz b/commons-compress-1.26.0-src.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..3b82d6c8cf17e8a6fa116ac39db5f7aa0ff4e48c
Binary files /dev/null and b/commons-compress-1.26.0-src.tar.gz differ