GitHub Advisoryadvisory · Maven

GHSA-fh5r-crhr-qrrq Apache CXF: Denial of Service vulnerability with temporary files

HIGH Published 2025-01-21 Modified 2025-12-16 Official page ↗
Aliases
CVE-2025-23184
Ecosystem
Maven
Packages
org.apache.cxf:cxf-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2025-01-21

Affected packages

• Maven org.apache.cxf:cxf-core: < 3.5.10 → fixed in 3.5.10 • Maven org.apache.cxf:cxf-core: >= 3.6.0, < 3.6.5 → fixed in 3.6.5 • Maven org.apache.cxf:cxf-core: >= 4.0.0, < 4.0.6 → fixed in 4.0.6

Description

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

Related

Alias · CVE (1)

  • CVE-2025-23184 A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References