CVEvulnerability
CVE-2025-23184
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2025-01-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
Description
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
Affected configurations
• apache cxf (< 3.5.10)
• apache cxf (>= 3.6.0 < 3.6.5)
• apache cxf (>= 4.0.0 < 4.0.6)
Related
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122 Mailing List
- http://www.openwall.com/lists/oss-security/2025/01/20/3 Mailing List
- https://security.netapp.com/advisory/ntap-20250214-0003/ security.netapp.com
- https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability www.vicarius.io
- https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability www.vicarius.io