CVE-2024-41172 Apache CXF: Unrestricted memory consumption in CXF HTTP clients

2024-07-1908:50:43

CWE-401

apache

www.cve.org

apache cxf

memory consumption

cve-2024-41172

http clients

EPSS

0.001

Percentile

38.6%

JSON

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache CXF",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.6.4, 4.0.5",
        "status": "affected",
        "version": "3.6.0, 4.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6

EPSS

0.001

Percentile

38.6%

JSON

Related for CVELIST:CVE-2024-41172