Apache CXF 3.6.x < 3.6.4, 4.0.x < 4.0.5 DoS

In versions of Apache CXF before 3.6.4 and 4.0.5 3.5.x and lower versions are not impacted, a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out o...

CVE-2024-41172

A memory consumption flaw was found in Apache CXF. This issue may allow a CXF HTTP client conduit to prevent HTTPClient instances from being garbage collected, eventually causing the application to run out of memory...

CVE-2024-32007

An improper input validation vulnerability was found in the p2c parameter in the Apache CXF JOSE. This flaw allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. Mitigation Mitigation for this issue is either not available or the...

CVE-2024-29736

A Server-side request forgery SSRF vulnerability was found in Apache CXF in the WADL service description. The flaw allows an attacker to perform SSRF-style attacks on REST web services. The attack only applies if a custom stylesheet parameter is configured. Mitigation Mitigation for this issue is...

Apache CXF Memory Consumption Vulnerability

Apache CXF is the United States Apache Apache Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. Apache CXF has a memory consumption vulnerability that originates from a client-side pipeline th...

The vulnerability of the HTTP client in Apache CXF web services allows attackers to trigger a service failure.

The vulnerability of the HTTP client component in Apache CXF web services is related to memory release errors. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

Memory Leak

org.apache.cxf: cxf-rt-transports-http is vulnerable to a Memory Leak. The vulnerability is caused due to the lack of proper shutdown handling for HTTPClient instances, which may lead to continuous memory consumption increase and eventually cause the application to run out of memory, resulting in...

Denial Of Service (DoS)

org.apache.cxf: cxf-rt-rs-security-jose is vulnerable to Denial Of Service DoS. The vulnerability is due to missing size restrictions in the p2c PBES2 count parameter, which allows an attacker to perform a Denial Of Service attack by specifying a large value for this parameter in a token...

Server-side Request Forgery (SSRF)

org.apache.cxf:cxf-rt-rs-service-description is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to insufficient validation of the stylesheetReference and path parameters, which can be exploited by an attacker to perform SSRF style attacks. Note that this vulnerability is...

com.craterdog.maven-parent-poms:java-web-service (>=3.11 <=3.22), com.devonfw.modules:devonfw-i18n (=2.4.0) +329 more potentially affected by CVE-2024-29736 via org.apache.cxf:cxf-rt-rs-service-description (>=3.0.0-milestone1 <=3.5.8)

org.apache.cxf:cxf-rt-rs-service-description MAVEN version =3.0.0-milestone1, =3.11, =1.0.0, =3.0.0, =3.0.0, =3.0.0, =1.7.2.230613, =1.7.2.230622, =2.2.24.11, =2.2.10, =2.2.7, =2.2.9.1, =2.2.7, =2.2.7, =2.2.23.1 and more Source cves: CVE-2024-29736 Source advisory: OSV:GHSA-5M3J-PXH7-455P...

com.amazon.opendistroforelasticsearch:opendistro_security (>=1.4.0.0 <=1.13.1.0), com.amazon.opendistroforelasticsearch:opendistro_security_advanced_modules (>=0.7.0.1 <=1.3.0.0) +215 more potentially affected by CVE-2024-32007 via org.apache.cxf:cxf-rt-rs-security-jose (>=3.0.2 <=3.5.8)

org.apache.cxf:cxf-rt-rs-security-jose MAVEN version =3.0.2, =1.4.0.0, =0.7.0.1, =6.0-21.0, =6.0.1-31.3, =4.2.0.1, =1.7.2.230613, =1.7.2.230622, =7.2.0, =6.3.0, =1.2.0, =1.2.0, =1.0.0, =1.0.0, =2.16.01 and more Source cves: CVE-2024-32007 Source advisory: OSV:GHSA-6PFF-FMH2-4MMF...

io.hyte.platform:hyte-db (=4.4.6.hyte-24270), io.hyte.platform:hyte-mq (=4.4.6.hyte-24270) +23 more potentially affected by CVE-2024-29736 via org.apache.cxf:cxf-rt-rs-service-description (>=3.6.0 <=3.6.3)

org.apache.cxf:cxf-rt-rs-service-description MAVEN version =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.11 and more Source cves: CVE-2024-29736 Source advisory: OSV:GHSA-5M3J-PXH7-455P...

cv.igrp:igrp-core (>=2.0.0.231123-RC1 <=2.0.0.250216-GA), net.n2oapp.framework.security:coverage (>=7.2.0 <=8.0.13) +111 more potentially affected by CVE-2024-29736 via org.apache.cxf:cxf-rt-rs-service-description (>=4.0.0 <=4.0.4)

org.apache.cxf:cxf-rt-rs-service-description MAVEN version =4.0.0, =2.0.0.231123-RC1, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =6.1.1, =4.0.0, =4.0.0, =4.0.0, =4.0.11 and more Source cves: CVE-2024-29736 Source advisory: OSV:GHSA-5M3J-PXH7-455P...

org.apache.camel.maven:camel-servicenow-maven-plugin (>=3.21.0 <=3.22.4), org.apache.camel.springboot:camel-servicenow-starter (>=3.21.0 <=3.22.4) +21 more potentially affected by CVE-2024-32007 via org.apache.cxf:cxf-rt-rs-security-jose (>=3.6.0 <=3.6.3)

org.apache.cxf:cxf-rt-rs-security-jose MAVEN version =3.6.0, =3.21.0, =3.21.0, =3.21.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.11 and more Source cves: CVE-2024-32007 Source advisory: OSV:GHSA-6PFF-FMH2-4MMF...

io.quarkiverse.cxf:quarkus-cxf-integration-test-ws-trust (>=2.0.0 <=3.13.0), io.quarkiverse.cxf:quarkus-cxf-services-sts (>=2.0.0 <=3.13.0) +23 more potentially affected by CVE-2024-32007 via org.apache.cxf:cxf-rt-rs-security-jose (>=4.0.0 <=4.0.4)

org.apache.cxf:cxf-rt-rs-security-jose MAVEN version =4.0.0, =2.0.0, =2.0.0, =2.0.0, =4.0.0, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.11 and more Source cves: CVE-2024-32007 Source a...

com.axonivy.ivy.tool.soap:cxf-client-codegen (=1.0.0), cv.igrp:igrp-core (>=1.7.3.230801 <=1.7.3.230802) +294 more potentially affected by CVE-2024-41172 via org.apache.cxf:cxf-rt-transports-http (>=3.6.0 <=3.6.3)

org.apache.cxf:cxf-rt-transports-http MAVEN version =3.6.0, =1.7.3.230801, =3.0-M3, =3.0-M3, =3.0-M3, =4.4.6.hyte-24270, =4.4.6.hyte-24270, =4.4.6.hyte-24270, =4.4.8.hyte-26150 - io.hyte.platform:repo =4.4.6.hyte-24270 - net.tirasa.connid.bundles:net.tirasa.connid.bundles.servicenow =1.0.4 -...

be.atbash.test:integration-testing (=2.2.0), be.atbash.test:integration-testing-database (=2.2.0) +511 more potentially affected by CVE-2024-41172 via org.apache.cxf:cxf-rt-transports-http (>=4.0.0 <=4.0.4)

org.apache.cxf:cxf-rt-transports-http MAVEN version =4.0.0, =1.0.0, =12.1-16, =0.0.1, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons =2.70.0 - com.codbex.kronos:codbex-kronos-components-api-parent =2.69.0 - com.codbex.kronos:codbex-kronos-components-engine-xsjob =2.69.0 -...

GHSA-6PFF-FMH2-4MMF Apache CXF Denial of Service vulnerability in JOSE

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token...

Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured...

Apache CXF Denial of Service vulnerability in JOSE

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token...