CVE-2024-41172

2024-07-1909:15:05

CWE-401

apache

web.nvd.nist.gov

apache cxf

http client

memory consumption

out of memory

vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

38.6%

JSON

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

Affected configurations

Nvd

Vulners

Vulnrichment

Node

apachecxfRange3.6.0–3.6.4

apachecxfRange4.0.0–4.0.5

VendorProductVersionCPE
apachecxf*cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	cxf	*	cpe:2.3:a:apache:cxf::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache CXF",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.6.4, 4.0.5",
        "status": "affected",
        "version": "3.6.0, 4.0.0",
        "versionType": "semver"
      }
    ]
  }
]