CVE-2024-41172

🗓️ 23 Jul 2024 09:17:40Reported by redhat.comType

Versions of Apache CXF may prevent HTTPClient instances from being garbage collected, leading to potential memory consumption issue

Reporter	Title	Published	Views	Family All 31
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance has multiple vulnerabilities	4 Oct 202409:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite -IoT Component uses cxf-rt-transports-http-4.0.4.jar which is vulnerable to CVE-2024-41172	28 Jan 202522:08	–	ibm
Tenable Nessus	Apache CXF 3.6.x < 3.6.4, 4.0.x < 4.0.5 DoS	26 Jul 202400:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.0.4 Security update (Important) (RHSA-2024:8823)	5 Nov 202400:00	–	nessus
Tenable Nessus	RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.0.4 Security update (Important) (RHSA-2024:8824)	6 Nov 202400:00	–	nessus
BDU FSTEC	The vulnerability of the HTTP client in Apache CXF web services allows attackers to trigger a service failure.	23 Jul 202400:00	–	bdu_fstec
Circl	CVE-2024-41172	19 Jul 202412:01	–	circl
CNNVD	Apache CXF 安全漏洞	19 Jul 202400:00	–	cnnvd
CNVD	Apache CXF Memory Consumption Vulnerability	23 Jul 202400:00	–	cnvd
CVE	CVE-2024-41172	19 Jul 202408:50	–	cve

Source	Link
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-41172
github	www.github.com/advisories/GHSA-4mgg-fqfq-64hg
lists	www.lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6
osv	www.osv.dev/vulnerability/GHSA-4mgg-fqfq-64hg
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

18 Oct 2024 22:59Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.13.7

EPSS0.01187