diff --git a/MODULE.bazel b/MODULE.bazel
index 8f33d2781a1da2..8aa3146a1b5fca 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -144,7 +144,7 @@ maven.install(
         "javax.inject:javax.inject:1",
         "net.bytebuddy:byte-buddy-agent:1.14.5",
         "net.bytebuddy:byte-buddy:1.14.5",
-        "org.apache.commons:commons-compress:1.19",
+        "org.apache.commons:commons-compress:1.24.0",
         "org.apache.commons:commons-pool2:2.8.0",
         "org.apache.tomcat:tomcat-annotations-api:8.0.5",
         "org.apache.velocity:velocity:1.7",
diff --git a/maven_install.json b/maven_install.json
index 7a415a04f59033..a56cc3dd2931ac 100644
--- a/maven_install.json
+++ b/maven_install.json
@@ -1,7 +1,7 @@
 {
   "__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY": "THERE_IS_NO_DATA_ONLY_ZUUL",
-  "__INPUT_ARTIFACTS_HASH": -271381572,
-  "__RESOLVED_ARTIFACTS_HASH": -474976451,
+  "__INPUT_ARTIFACTS_HASH": 958863960,
+  "__RESOLVED_ARTIFACTS_HASH": -1557404927,
   "conflict_resolution": {
     "com.google.code.gson:gson:2.8.9": "com.google.code.gson:gson:2.9.0",
     "com.google.errorprone:error_prone_annotations:2.3.2": "com.google.errorprone:error_prone_annotations:2.23.0",
@@ -570,9 +570,9 @@
     },
     "org.apache.commons:commons-compress": {
       "shasums": {
-        "jar": "ff2d59fad74e867630fbc7daab14c432654712ac624dbee468d220677b124dd5"
+        "jar": "fbf2c5d275e513c08f4e4fb539726dbf3ac2142af956ba93efb983244f0c36bd"
       },
-      "version": "1.19"
+      "version": "1.24.0"
     },
     "org.apache.commons:commons-pool2": {
       "shasums": {
@@ -1934,6 +1934,13 @@
       "org.apache.commons.compress.compressors.xz",
       "org.apache.commons.compress.compressors.z",
       "org.apache.commons.compress.compressors.zstandard",
+      "org.apache.commons.compress.harmony",
+      "org.apache.commons.compress.harmony.archive.internal.nls",
+      "org.apache.commons.compress.harmony.pack200",
+      "org.apache.commons.compress.harmony.unpack200",
+      "org.apache.commons.compress.harmony.unpack200.bytecode",
+      "org.apache.commons.compress.harmony.unpack200.bytecode.forms",
+      "org.apache.commons.compress.java.util.jar",
       "org.apache.commons.compress.parallel",
       "org.apache.commons.compress.utils"
     ],
diff --git a/src/test/py/bazel/bazel_external_repository_test.py b/src/test/py/bazel/bazel_external_repository_test.py
index 4f7279a73941a5..4e56e1399cf1ab 100644
--- a/src/test/py/bazel/bazel_external_repository_test.py
+++ b/src/test/py/bazel/bazel_external_repository_test.py
@@ -51,7 +51,7 @@ def setUp(self):
     test_base.TestBase.setUp(self)
     for f in [
         'six-1.10.0.tar.gz', 'archive_with_symlink.zip',
-        'archive_with_symlink.tar.gz'
+        'archive_with_symlink.tar.gz', 'sparse_archive.tar',
     ]:
       self.CopyFile(self.Rlocation('io_bazel/src/test/py/bazel/testdata/'
                                    'bazel_external_repository_test/' + f), f)
@@ -162,6 +162,47 @@ def testNewHttpTarArchiveWithSymlinks(self):
         '@archive_with_symlink//:file-A',
     ])
 
+  def testNewHttpTarWithSparseFile(self):
+    # Test extraction of tar archives containing sparse files.
+    # The archive under test was produced using GNU tar on Linux:
+    #   truncate -s 1M sparse_file
+    #   tar --create --sparse --format posix --file sparse_archive.tar sparse_file
+
+    ip, port = self._http_server.server_address
+    rule_definition = [
+        'load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")',
+        'http_archive(',
+        '    name = "sparse_archive",',
+        '    urls = ["http://%s:%s/sparse_archive.tar"],' % (ip, port),
+        '    build_file = "@//:sparse_archive.BUILD",',
+        '    sha256 = ',
+        '  "a1a2b2ce4acd51a8cc1ab80adce6f134ac73e885219911a960a42000e312bb65",'
+        ')',
+    ]
+    rule_definition.extend(self.GetDefaultRepoRules())
+    self.ScratchFile('WORKSPACE', rule_definition)
+    self.ScratchFile('sparse_archive.BUILD', [
+        'exports_files(["sparse_file"])',
+    ])
+    self.ScratchFile('test.py', [
+        'import sys',
+        'if open(sys.argv[1], "rb").read() != b"\\0"*1024*1024:',
+        '  sys.stderr.write(repr(open(sys.argv[1], "rb").read()) + "\\n")',
+        '  sys.exit(1)',
+    ])
+    self.ScratchFile('BUILD', [
+        'py_test(',
+        '    name = "test",',
+        '    srcs = ["test.py"],',
+        '    args = ["$(location @sparse_archive//:sparse_file)"],'
+        '    data = ["@sparse_archive//:sparse_file"],'
+        ')',
+    ])
+    self.RunBazel([
+        'test',
+        '//:test',
+    ])
+
   def _CreatePyWritingStarlarkRule(self, print_string):
     self.ScratchFile('repo/foo.bzl', [
         'def _impl(ctx):',
diff --git a/src/test/py/bazel/testdata/bazel_external_repository_test/sparse_archive.tar b/src/test/py/bazel/testdata/bazel_external_repository_test/sparse_archive.tar
new file mode 100644
index 00000000000000..693e027a62bb43
Binary files /dev/null and b/src/test/py/bazel/testdata/bazel_external_repository_test/sparse_archive.tar differ