CVE-2024-32007 Apache CXF Denial of Service vulnerability in JOSE

2024-07-1908:50:31

CWE-20

CWE-400

apache

github.com

cve-2024-32007

apache cxf

jose

denial of service

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "cxf",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.0.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "3.6.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "3.5.9",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]