Vulnerability · Published Jan 21, 2025 · Assigned by apache
CVE-2025-23184Apache CXF: Denial of Service vulnerability with temporary files
Medium 5.9
In plain English
A medium-severity uncontrolled resource consumption in Apache CXF from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.cxf:cxf-core | 3.5.10 | GHSA-fh5r-crhr-qrrq |
| Maven | org.apache.cxf:cxf-core | 3.6.5 | GHSA-fh5r-crhr-qrrq |
| Maven | org.apache.cxf:cxf-core | 4.0.6 | GHSA-fh5r-crhr-qrrq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache CXF | 0 – before 3.5.103.6.0 – before 3.6.54.0.0 – before 4.0.6 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122 vendor-advisory
- http://www.openwall.com/lists/oss-security/2025/01/20/3
- https://security.netapp.com/advisory/ntap-20250214-0003/
- https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability